Anthropic-Cybersecurity-Skills/skills/implementing-mitre-attack-coverage-mapping/references/workflows.md

Workflows - MITRE ATT&CK Coverage Mapping

Quarterly Coverage Assessment Workflow

1. Export all active SIEM detection rules
   |
   v
2. Map each rule to MITRE ATT&CK technique(s)
   |
   v
3. Score each technique (0-100)
   |
   v
4. Generate ATT&CK Navigator heatmap
   |
   v
5. Identify top 10 gap techniques
   |
   v
6. Prioritize based on threat landscape
   |
   v
7. Create detection engineering backlog
   |
   v
8. Build and deploy new rules
   |
   v
9. Validate with adversary emulation
   |
   v
10. Update coverage map

Continuous Improvement Cycle

Assess Coverage --> Identify Gaps --> Prioritize -->
Build Rules --> Test Rules --> Deploy --> Validate -->
Measure --> Report --> Repeat

Gap Closure Tracking

Week	New Rules	Techniques Covered	Coverage Delta
1	3	T1059, T1055, T1003	+1.5%
2	2	T1053, T1547	+1.0%
3	3	T1071, T1105, T1048	+1.5%
4	2	T1218, T1036	+1.0%