Question

Your SOC lead wants to understand which MITRE ATT&CK tactics and techniques are actively covered by your Microsoft Sentinel detections, and to identify gaps where no analytics rules exist. She asks you to produce this visibility using built-in Sentinel capabilities without exporting data to an external tool. Which approach should you use?

Accepted Answer

Open the MITRE ATT&CK (Preview) page in Sentinel, which maps active scheduled and near-real-time analytics rules to techniques and highlights uncovered tactics.

Answer

Run a KQL query against the SecurityAlert table and group by the Tactics column to build a technique coverage report.

Answer

Enable all available Fusion and anomaly rules, since these automatically guarantee full MITRE ATT&CK coverage across all tactics.

Answer

Use the SOC optimization page, which is designed specifically to display MITRE technique-to-rule mappings and coverage gaps.