The ATT&CK Detection Coverage Heatmap: Balancing Security…

What the ATT&CK Detection Coverage Heatmap Is

The ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a widely recognized model for describing cyber-attack techniques. The detection coverage heatmap visualizes how well security rules can detect these tactics in a simulated environment. Each cell represents a specific tactic or data source combination.

By hovering over any cell, users can inspect the current state of that particular tactic's detection rate and false-positive ratio, providing insights into the effectiveness of the security measures.

Why It Matters

The heatmap is crucial for cybersecurity professionals as it helps in understanding the trade-offs between detection coverage and false positives. This balance is critical because overly sensitive rules can lead to a high number of false alarms, while less sensitive rules might miss actual threats.

By simulating different scenarios with varying rule authoring rates, telemetry drifts, and alert thresholds, organizations can optimize their security strategies for better protection against cyber threats.

live demo · related simulation● LIVE

How It Works

The heatmap dynamically updates based on the rate at which new security rules are authored (rule authoring), how quickly telemetry data changes (telemetry drift), and the threshold at which alerts are generated (alert threshold). These parameters can be adjusted to reflect real-world conditions or hypothetical scenarios.

By toggling between coverage and MTTD/false-positive trends, users can analyze not only the current state of detection but also historical performance metrics, providing a comprehensive view of security effectiveness.

Real-World Applications

In practice, organizations use similar models to continuously improve their cybersecurity posture. By identifying weak points in their detection strategies, they can refine their rules and data collection methods to better identify and respond to threats.

The heatmap serves as a valuable tool for training security analysts and for conducting what-if scenarios to prepare for potential cyber attacks.

Frequently asked questions

What does the color of each cell in the heatmap represent?

The color represents the detection coverage or false-positive rate of that specific tactic or data source combination, with warmer colors indicating higher values and cooler colors lower values.

How can organizations use this heatmap to improve their security measures?

Organizations can identify areas where they need to enhance their security rules or telemetry collection methods. By focusing on cells with low detection coverage, they can prioritize rule updates and data improvements to better protect against cyber threats.

What is the significance of the alert threshold slider?

The alert threshold slider allows users to adjust how sensitive their security system is to potential threats. Lower thresholds increase detection recall but may also lead to more false positives, while higher thresholds reduce false positives at the cost of potentially missing actual threats.

How does telemetry drift affect the heatmap?

Telemetry drift represents changes in data patterns over time. As telemetry data evolves, existing security rules may become less effective. The heatmap reflects this by showing how detection coverage and false-positive rates change as new data is introduced.

Try it live

Everything above runs in your browser — open ATT&CK Detection Coverage Heatmap (2D) and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open ATT&CK Detection Coverage Heatmap (2D) simulation

The ATT&CK Detection Coverage Heatmap: Balancing Security and False Positives