Question

A SOC lead wants to visualize which adversary techniques the team can currently detect versus which have no detection coverage. She maps existing detection rules to their corresponding technique IDs and produces a color-coded matrix that highlights defended techniques in green and undefended ones in red. Which use of the MITRE ATT&CK framework does this activity best represent?

Accepted Answer

Building an ATT&CK Navigator heat map to identify detection coverage gaps

Answer

Producing a Diamond Model diagram to correlate adversary infrastructure

Answer

Mapping the Cyber Kill Chain to sequence an incident timeline

Answer

Generating STIX bundles to share indicators over a TAXII feed