<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-detection-gap-analysis
description: >-
  Identify and prioritize detection gaps by correlating ATT&CK coverage layers
  with threat intelligence, telemetry inventories, and SIEM rule repositories.
  Produces prioritized remediation plans with Sigma rule recommendations.
domain: cybersecurity
subdomain: purple-team
tags:
  - gap-analysis
  - detection-engineering
  - mitre-attack
  - coverage-mapping
  - threat-intelligence
  - sigma
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001", "T1059.001"]
---

# Building Detection Gap Analysis

## Overview

Detection gap analysis identifies where your security monitoring has blind spots —
techniques that adversaries use but your SIEM, EDR, or NDR cannot detect. This
skill produces a prioritized gap report correlating ATT&CK coverage, threat
intelligence on active adversaries, and available telemetry sources.

## Prerequisites

| Requirement | Install |
|---|---|
| mitreattack-python | `pip install mitreattack-python` |
| sigma-cli | `pip install sigma-cli` |
| ATT&CK Navigator | Web UI or local instance |
| Python 3.10+ | For agent tooling |
| jq | JSON processing |

## Key Concepts

### Gap Categories

| Category | Description | Priority |
|---|---|---|
| Blind spot | No telemetry — log source not collected | Critical |
| Silent gap | Telemetry exists but no detection rule | High |
| Weak detection | Rule exists but low fidelity or high FP | Medium |
| Unvalidated | Rule exists but never tested against real technique | Low |

### Prioritization Matrix

Gaps are scored by: `threat_frequency × impact × exploitability - current_coverage`

```
Priority = (ThreatActorUsage × TechniqueImpact × DataAvailability) - CoverageScore
```

## Workflow

### 1. Inventory Current Detections

```bash
# Extract ATT&CK mappings from all Sigma rules
grep -rh 'attack\.t' rules/ | sort | uniq -c | sort -rn > technique_counts.txt

# Map rules per tactic
node scripts/agent.js inventory --rules-dir rules/ --output inventory.json

# Check telemetry sources
node scripts/agent.js telemetry-check \
  --siem-config siem_sources.json \
  --output telemetry.json
```

### 2. Import Threat Intelligence

```bash
# Get techniques used by priority threat actors
python3 -c "
from mitreattack.stix20 import MitreAttackData
attack = MitreAttackData('enterprise-attack.json')
group = attack.get_group_by_alias('APT29')
techs = attack.get_techniques_used_by_group(group)
for t in techs:
    ext = t['external_references'][0]
    print(f\"{ext['external_id']}: {t['name']}\")
"
```

### 3. Generate Gap Report

```bash
# Full gap analysis
node scripts/agent.js analyze \
  --inventory inventory.json \
  --threat-actors APT29,FIN7,Lazarus \
  --telemetry telemetry.json \
  --output gap-report.json

# Generate remediation plan
node scripts/agent.js remediation-plan \
  --gaps gap-report.json \
  --max-rules 20 \
  --output plan.json
```

### 4. Track Remediation

```bash
# Update gap status after deploying new rules
node scripts/agent.js update-status \
  --gaps gap-report.json \
  --closed T1003.001,T1059.001 \
  --output updated-gaps.json
```

## Detection

```yaml
title: Detection Gap Analysis Detection
id: ef3b30ef-a696-4a90-8432-38874b4dab13
status: experimental
description: Detects suspicious activity related to building detection gap analysis techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*detection*"
  condition: selection
level: medium
tags:
  - attack.t1003.001
  - attack.t1059.001
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| All rules inventoried | Rule count matches `find rules/ -name '*.yml' | wc -l` |
| Threat actors loaded | Technique list matches ATT&CK group profiles |
| Gaps categorized | Every gap has category (blind/silent/weak/unvalidated) |
| Priorities assigned | Top 10 gaps align with threat model |
| Remediation actionable | Each gap has specific Sigma rule recommendation |

## References

- [DeTT&CT Framework](https://github.com/rabobank-cdc/DeTTECT)
- [MITRE ATT&CK Data Sources](https://attack.mitre.org/datasources/)
- [Sigma Rule Repository](https://github.com/SigmaHQ/sigma)
