detection-coverage-mapping
Map detection and control coverage against ATT&CK (or equivalent) techniques — honest heatmaps, gaps, and prioritization from exercises and telemetry. Use when measuring blue-team coverage, planning purple team roadmaps, or reporting defensive capability.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- detection-coverage-mapping
- description
- Map detection and control coverage against ATT&CK (or equivalent) techniques — honest heatmaps, gaps, and prioritization from exercises and telemetry. Use when measuring blue-team coverage, planning purple team roadmaps, or reporting defensive capability.
03 SKILL.md 正文
Detection Coverage Mapping
Overview
Coverage mapping shows which adversary techniques you can prevent, detect, or neither. Done honestly, it guides investment; done as theater, it invents green cells.
When to Use
- After red/purple exercises
- Building a detection engineering roadmap
- Board/technical reporting on defensive capability
- Comparing coverage before/after control changes
Core Practices
- Choose a framework layer (e.g. ATT&CK tactics/techniques relevant to your stack)
- Define scoring clearly: prevented / detected with alert / telemetry only / blind
- Base scores on tests and telemetry reality, not documentation claims
- Prioritize gaps on techniques used by relevant adversaries and on critical paths
- Link each gap to backlog work (telemetry, rule, control, process)
- Refresh maps on a cadence and after major stack changes
Principles
- “We have a tool that could detect X” ≠ “we detect X in production”
- Coverage of irrelevant techniques is vanity
- Purple team results should update the map quickly
- Trend lines matter more than a single perfect heatmap slide
Verification
- [ ] Scoring definitions are explicit and consistent
- [ ] High-priority gaps have owners and actions
- [ ] Map is updated from real exercises/telemetry, not aspiration
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.