MITRE ATT&CK Coverage Heatmap App

Tines Stories: Show + Tell
1

As a former detection engineer, this interactive detection coverage heatmap was something of my dreams from a few years ago.

The backend detection information is stored in Tines Records, which you can populate from whatever your source of truth (or truths, let’s be honest) is for detection information. I then hooked this into my App via an Endpoint that grabs my Record data.

Some of the features I was able to add:

  • Search by techniques and sub-techniques (name or id)
  • Expand or collapse sub-techniques
  • Pop-out additional information on the coverage of the technique or sub-technique
  • Filter based on coverage and data source of the detection
  • Additional visualization of compliance requirements and threat intelligence against your coverage
  • Custom configuration of thresholds and color themes

image
image1878×978 185 KB

6 Likes
2

This is really cool!!

3

This is super cool! We’re looking at having a view in our team metrics dashboard app that applies similar logic, but looks at detection coverge, alert classifications, and threat hunt coverage in a single view, with colors representing each function, shading to show “volume” of coverage, and filters to focus in on just one or a subset of functions in the heatmap.

Thanks for sharing!

4 Likes
4

Oh, this is beautiful.

Mind Blown Reaction

1 Like