VERISCO Alertio Investigate
MITRE ATT&CK coverage
Which attack techniques your fleet actually detected in a period, and which produced nothing at all. A measured view of your blind spots.
Open ATT&CK Coverage in the Investigate group.
What it measures#
Every alert that carries a MITRE ATT&CK technique is counted against it. The matrix arranges 97 techniques under 14 tactics, and shades each technique by how many alerts fired against it in the period you choose.
| Shading | Detections in the period |
|---|---|
| None (grey) | 0 |
| Light | 1 – 9 |
| Moderate | 10 – 39 |
| Strong | 40 – 99 |
| Heavy | 100 or more |
The four figures at the top summarise it: technique coverage as a percentage, covered techniques, blind spots, and the detections mapped to ATT&CK in the period.
Coverage is measured from what your sensors really raised, not from what your rules could in theory detect. A technique your rules cover but nobody attempted stays grey, which is why coverage narrows as the time range shortens.
Working the screen#
| Control | What it does |
|---|---|
| Time range | Sets the period. Set it first. |
| Platform | All, Windows, Linux, macOS or Cloud. Restricts the matrix to techniques for that platform. |
| Blind spots only | Hides everything you already detect. What is left is a ready-made detection-engineering backlog. |
| Technique cell | Opens the technique: its description and the activity against it. Open Alerts shows the detections behind it. |
| Refresh | Recalculates the matrix. |
Grey is normal
Every real environment has many blind spots. Use this screen to choose which ones to close first, starting with the techniques that matter most to the attacks you expect.
Something missing or wrong on this page? Tell us and we will fix it.