---
name: MITRE ATT&CK Coverage Gap
description: Map active Microsoft Sentinel and Defender XDR detections to MITRE ATT&CK tactics and techniques, then report where coverage is missing.
---

# MITRE ATT&CK Coverage Gap

> **TL;DR:** This skill reads your active detections in Microsoft Sentinel and Microsoft Defender XDR, lines them up against the MITRE ATT&CK tactics and techniques, and shows you exactly where your detection coverage has holes.

## How does MITRE ATT&CK coverage work across Microsoft Sentinel and Defender XDR?

Microsoft Sentinel includes a MITRE ATT&CK page that maps your active scheduled and near real-time (NRT) analytics rules onto the framework's tactics and techniques, while Microsoft Defender XDR contributes detections from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. When Microsoft Sentinel is onboarded to the Microsoft Defender portal, these signals sit side by side in unified security operations. This skill inspects both surfaces to build a single coverage picture and to surface techniques where no active detection exists.

## When should you run this skill?

- "Where are the gaps in our MITRE ATT&CK detection coverage?"
- "Which tactics have no active analytics rules in Microsoft Sentinel?"
- "Are our Defender XDR detections covering credential access and lateral movement?"
- "Show me techniques we could cover by enabling existing rule templates."
- "Map our current detections to ATT&CK before the next board security review."
- "Which high-value techniques rely on a single detection we should reinforce?"
- "How does our coverage compare to recommended detections for these tactics?"

## How this skill works, step by step

1. Confirm read-only access to the Microsoft Defender portal and, where applicable, the Microsoft Sentinel workspace.
2. Enumerate active scheduled query and NRT analytics rules in Microsoft Sentinel and read the MITRE technique tags applied to each.
3. Read the Microsoft Sentinel MITRE ATT&CK coverage page to capture currently active and simulated (available but not configured) coverage.
4. Enumerate active Defender XDR custom detection rules and note their mapped tactics and techniques.
5. Normalise all detections to the aligned MITRE ATT&CK framework version and group them by tactic and technique ID.
6. Identify techniques with no active detection (gaps) and techniques with only a single active detection (thin coverage).
7. Compare active coverage against Microsoft's recommended detections and security services for each technique.
8. Derive a coverage score per tactic as the proportion of recommended techniques with at least one active detection, weighting single-detection techniques as partial.
9. Compile the gap list, ranking by tactic prevalence and number of missing high-value techniques.

## Output format

The skill produces a per-tactic coverage table followed by a prioritised gap summary.

| Tactic | Technique ID | Technique name | Active detections | Source | Coverage status |
| --- | --- | --- | --- | --- | --- |
| Credential Access | T1110 | Brute Force | 2 | Sentinel, Defender XDR | Covered |
| Lateral Movement | T1021 | Remote Services | 1 | Defender XDR | Thin |
| Exfiltration | T1048 | Exfiltration Over Alternative Protocol | 0 | None | Gap |

Summary highlights:

- Tactics fully covered, partially covered, and not covered, with a coverage score per tactic.
- Count of techniques with zero active detections (gaps) and with a single detection (thin coverage).
- Techniques where enabling an existing analytics rule template or simulated detection would close a gap.
- Highest-priority gaps ranked by tactic prevalence and recommended-detection shortfall.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Sentinel MITRE ATT&CK coverage page and analytics rules | Microsoft Sentinel (Azure subscription, pay-as-you-go log ingestion) |
| Defender XDR advanced hunting and custom detections | Microsoft 365 E5 or Microsoft Defender XDR component licences (for example Defender for Endpoint P2) |

### Least-privilege roles

- Microsoft Sentinel Reader (read analytics rules and MITRE coverage)
- Security Reader (read Defender XDR detections and advanced hunting)
- Global Reader (tenant-wide read where cross-portal visibility is needed)

### Microsoft Graph permissions (read-only)

- The Microsoft Sentinel MITRE ATT&CK page and analytics rules are inspected through the Microsoft Defender or Azure portal and Azure Resource Manager, not Microsoft Graph; use the Microsoft Sentinel Reader role rather than a Graph scope.
- `ThreatHunting.Read.All` - reads Defender XDR advanced hunting data via the Microsoft Graph security API to validate which techniques active detections actually query.
- `SecurityEvents.Read.All` - reads security alerts and related events to confirm detections are firing against the mapped techniques.

## Scope and safety

This skill is read-only by default. It inspects detection configuration and coverage metadata only and never changes your security posture.

This skill does NOT:

- Create, enable, disable, or modify any analytics rule or custom detection.
- Run response actions such as isolating devices, quarantining files, or blocking URLs.
- Ingest, export, or alter any log, incident, or hunting data.
- Change MITRE technique tags or any role, permission, or connector configuration.

## Sources and compliance

- [View MITRE ATT&CK framework coverage in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage)
- [Proactively hunt for threats with advanced hunting in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview)
- Maps to Essential Eight regular review of detection coverage and to ISM controls for event logging and monitoring, supporting timely detection of cyber security incidents.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.