Question

A financial services company's SOC uses Microsoft Sentinel and Defender XDR. During a maturity review, the CISO asks the security architect to demonstrate which adversary techniques the organization can currently detect, identify blind spots, and prioritize new analytics rules against the tactics most relevant to recent threat actor campaigns targeting the finance sector. Which approach best satisfies this requirement?

Accepted Answer

Use the MITRE ATT&CK coverage feature in Sentinel to map active and simulated analytics rules to techniques, then prioritize rule creation for uncovered techniques associated with the relevant threat actors.

Answer

Enable all built-in Sentinel analytics rule templates at once to maximize technique coverage regardless of relevance.

Answer

Configure Defender for Cloud regulatory compliance dashboards to report on PCI DSS control coverage as a proxy for detection maturity.

Answer

Increase the log retention period in the Log Analytics workspace to ensure historical data is available for all possible techniques.