Knowledge / detection frameworks

MITRE ATT&CK

A knowledge base of adversary tactics and techniques. Use it to find detection gaps, not to decorate a slide.

MITRE ATT&CK / defensive useTacticswhyTechniqueshowCoveragedo we see itGapsfix detectA heatmap is not a program. Map to detections you actually run.

ATT&CK is a matrix of tactics (the goal) and techniques (the method). Defenders map telemetry and detections onto it to see coverage and holes.

A heatmap produced once for a board pack is interior design. A living map tied to detections you run is engineering.

Stay at technique level unless you are a detection engineer. This site does not document how to perform the techniques.