<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-detection-coverage-analysis
description: >-
  Map and analyze detection coverage against MITRE ATT&CK using
  DeTT&CT, identify blind spots, prioritize gaps by threat relevance,
  and track coverage improvements over time.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - detection-coverage
  - attack-mapping
  - dettect
  - coverage-heatmap
  - blind-spots
  - gap-prioritization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Detection Coverage Analysis

## Overview

Detection coverage analysis quantifies how well detections address
the threat landscape. Covers ATT&CK mapping, DeTT&CT scoring, heatmap
generation, blind spot identification, and improvement tracking.

## Prerequisites

| Requirement | Purpose |
|---|---|
| DeTT&CT | ATT&CK coverage visualization |
| Detection inventory | Catalog of active rules |
| Threat intelligence | Relevant threat actor TTPs |

## Key Concepts

### Coverage Scoring Model

```python
coverage_scores = {
    "T1059.001": {"score": 4, "data_sources": ["sysmon", "edr"], "rules": 3},
    "T1003.001": {"score": 3, "data_sources": ["sysmon"], "rules": 2},
    "T1053.005": {"score": 1, "data_sources": ["windows_events"], "rules": 1},
    "T1078.002": {"score": 0, "data_sources": [], "rules": 0},  # blind spot
}
# Levels: 0=none, 1=minimal, 2=partial, 3=good, 4=excellent
```

## Workflow

1. **Inventory detections** — Catalog all rules with ATT&CK mapping
2. **Score coverage** — Rate each technique 0-4 by quality
3. **Generate heatmap** — Visualize across ATT&CK matrix
4. **Identify blind spots** — Techniques with score 0 or 1
5. **Prioritize by threat** — Cross-reference with threat actor TTPs
6. **Plan remediation** — Schedule detection development for gaps
7. **Track improvement** — Measure coverage score over time

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
