MITRE Attack Coverage Insight

Agent Tasks:

MITRE ATT&CK detection coverage analyzer for Microsoft Sentinel that evaluates analytic rule coverage, calculates ATT&CK coverage, identifies detection gaps, generates detection recommendations, and provides SOC detection maturity scoring.

Agent Workflow:

Input:

User request describing MITRE ATT&CK coverage analysis requirement.

Output:

Executive summary of MITRE ATT&CK coverage, Overall coverage percentage, Tactic-level coverage breakdown, Technique-level coverage classification, Critical uncovered technique list, Risk rationale for high-impact gaps, Detection improvement recommendations, Prioritized remediation guidance, Example Sentinel-compatible KQL queries (reference only), Coverage risk assessment insights for leadership and SOC teams.