Attack Mapping Agent

Attack Mapping Agent ensures that your MITRE ATT&CK coverage metrics in Microsoft Sentinel are accurate, consistent, and operationally meaningful. It automatically inventories all analytic rules, validates their ATT&CK tactic, technique, and sub-technique assignments, and provides precise remediation recommendations for automation or analyst review.

It reads the alerts of your Microsoft Sentinel analytic rules through Microsoft Defender advanced hunting.

Agent tasks: Analytic rule discovery from Sentinel alerts, canonical rule ID assignment, ATT&CK metadata normalization (trim, uppercase, deduplicate, translate to IDs), malformed or missing mapping detection, tactic, technique and sub-technique validation, mapping suggestions with rationale, deduplicated review summary

Input: Microsoft Sentinel alerts via Microsoft Defender advanced hunting (SecurityAlert) with analytic rule names, IDs, tactics, techniques, sub-techniques, severities and sample alerts, no configuration required

Output: Attack mapping review with summary (rules reviewed, rules with suggested changes, unchanged rules), per-rule original vs. suggested tactics, techniques and sub-techniques, rationale per change, flags for empty or malformed MITRE metadata

We also offer a managed CSOC service with 24/7/365 proactive search, monitoring and response capabilities. Learn more: CSOC by glueckkanja.

Need help or have questions regarding the agent? E-Mail us at support.agents@glueckkanja.com