<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-detection-gap-remediation
description: >-
  Prioritize and remediate detection coverage gaps using threat
  intelligence, risk-based prioritization, data source analysis,
  and systematic detection development sprints.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - gap-remediation
  - coverage-improvement
  - threat-driven
  - risk-prioritization
  - data-source-analysis
  - detection-sprints
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Detection Gap Remediation

## Overview

Detection gap remediation systematically closes coverage blind spots.
Covers gap prioritization using threat intelligence, data source
availability analysis, detection development sprints, and progress tracking.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Coverage analysis | ATT&CK coverage gaps identified |
| Threat intelligence | Relevant threat actor TTPs |
| Data source inventory | Available telemetry catalog |

## Key Concepts

### Gap Remediation Priority Model

```python
gap_priority = {
    "T1078.002": {
        "gap_score": 0, "threat_relevance": "high",
        "data_available": True, "effort": "medium",
        "priority": 1,  # High relevance + data available = top priority
    },
    "T1218.011": {
        "gap_score": 1, "threat_relevance": "medium",
        "data_available": True, "effort": "low",
        "priority": 2,
    },
    "T1055.001": {
        "gap_score": 0, "threat_relevance": "high",
        "data_available": False, "effort": "high",
        "priority": 3,  # Need data source first
    },
}
```

## Workflow

1. **Review coverage gaps** — Import from coverage analysis results
2. **Assess threat relevance** — Score gaps against threat intelligence
3. **Check data availability** — Verify telemetry exists for detection
4. **Prioritize remediation** — Rank by threat relevance × data availability
5. **Plan detection sprints** — Group gaps into development iterations
6. **Develop detections** — Author, validate, and test new rules
7. **Measure improvement** — Update coverage scores after deployment

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
