# Coverage Gap Analysis Strategy

## Phase 1: ATT&CK Layer Import (budget: 20%)
1. Load current detection coverage as ATT&CK Navigator layer
2. If no layer exists: inventory all detection rules and map to techniques
3. Identify coverage levels: full detection, partial, alert-only, none
4. Baseline: count techniques with detection vs total applicable techniques

## Phase 2: Per-Technique Audit (budget: 40%)
1. For each uncovered or partially covered technique:
   - Is the technique relevant to our environment?
   - Are the required data sources available?
   - What would detection look like? (expected observables)
   - Estimated false positive rate for a basic detection
2. Prioritize by: prevalence in real attacks, relevance to environment, data source availability

## Phase 3: Gap Report (budget: 25%)
1. Produce coverage heatmap: ATT&CK matrix with red/yellow/green
2. List top-10 highest-priority gaps with:
   - Technique ID and name
   - Why it's high priority (threat intel, prevalence)
   - Required data source
   - Recommended detection approach
   - Estimated effort to implement
3. Group by data source dependency — efficient to fix gaps that share a data source

## Phase 4: Remediation Plan (budget: 15%)
1. Quick wins: techniques detectable with existing data sources
2. Medium-term: techniques requiring new log collection
3. Long-term: techniques requiring new tools or capabilities
4. Map to team sprints or project milestones

## Pivot Triggers
- No ATT&CK mapping exists → start with automated mapping from rule titles/tags
- Too many gaps → focus on top 10 by threat intel priority
- Data sources missing → document as prerequisite, recommend collection plan
