MITRE ATT&CK Coverage Gap

TL;DR: This skill reads your active detections in Microsoft Sentinel and Microsoft Defender XDR, lines them up against the MITRE ATT&CK tactics and techniques, and shows you exactly where your detection coverage has holes.

How does MITRE ATT&CK coverage work across Microsoft Sentinel and Defender XDR?

Microsoft Sentinel includes a MITRE ATT&CK page that maps your active scheduled and near real-time (NRT) analytics rules onto the framework’s tactics and techniques, while Microsoft Defender XDR contributes detections from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. When Microsoft Sentinel is onboarded to the Microsoft Defender portal, these signals sit side by side in unified security operations. This skill inspects both surfaces to build a single coverage picture and to surface techniques where no active detection exists.

When should you run this skill?

• “Where are the gaps in our MITRE ATT&CK detection coverage?”
• “Which tactics have no active analytics rules in Microsoft Sentinel?”
• “Are our Defender XDR detections covering credential access and lateral movement?”
• “Show me techniques we could cover by enabling existing rule templates.”
• “Map our current detections to ATT&CK before the next board security review.”
• “Which high-value techniques rely on a single detection we should reinforce?”
• “How does our coverage compare to recommended detections for these tactics?”

How this skill works, step by step

1. Confirm read-only access to the Microsoft Defender portal and, where applicable, the Microsoft Sentinel workspace.
2. Enumerate active scheduled query and NRT analytics rules in Microsoft Sentinel and read the MITRE technique tags applied to each.
3. Read the Microsoft Sentinel MITRE ATT&CK coverage page to capture currently active and simulated (available but not configured) coverage.
4. Enumerate active Defender XDR custom detection rules and note their mapped tactics and techniques.
5. Normalise all detections to the aligned MITRE ATT&CK framework version and group them by tactic and technique ID.
6. Identify techniques with no active detection (gaps) and techniques with only a single active detection (thin coverage).
7. Compare active coverage against Microsoft’s recommended detections and security services for each technique.
8. Derive a coverage score per tactic as the proportion of recommended techniques with at least one active detection, weighting single-detection techniques as partial.
9. Compile the gap list, ranking by tactic prevalence and number of missing high-value techniques.

Output format

The skill produces a per-tactic coverage table followed by a prioritised gap summary.

Summary highlights:

• Tactics fully covered, partially covered, and not covered, with a coverage score per tactic.
• Count of techniques with zero active detections (gaps) and with a single detection (thin coverage).
• Techniques where enabling an existing analytics rule template or simulated detection would close a gap.
• Highest-priority gaps ranked by tactic prevalence and recommended-detection shortfall.

Licensing and permissions

Licences and add-ons

Least-privilege roles

• Microsoft Sentinel Reader (read analytics rules and MITRE coverage)
• Security Reader (read Defender XDR detections and advanced hunting)
• Global Reader (tenant-wide read where cross-portal visibility is needed)

Microsoft Graph permissions (read-only)

• The Microsoft Sentinel MITRE ATT&CK page and analytics rules are inspected through the Microsoft Defender or Azure portal and Azure Resource Manager, not Microsoft Graph; use the Microsoft Sentinel Reader role rather than a Graph scope.
• ThreatHunting.Read.All - reads Defender XDR advanced hunting data via the Microsoft Graph security API to validate which techniques active detections actually query.
• SecurityEvents.Read.All - reads security alerts and related events to confirm detections are firing against the mapped techniques.

Scope and safety

This skill is read-only by default. It inspects detection configuration and coverage metadata only and never changes your security posture.

This skill does NOT:

• Create, enable, disable, or modify any analytics rule or custom detection.
• Run response actions such as isolating devices, quarantining files, or blocking URLs.
• Ingest, export, or alter any log, incident, or hunting data.
• Change MITRE technique tags or any role, permission, or connector configuration.

Related skills

• Sentinel Data Connector Coverage: run first to confirm which log sources are ingesting
• Sentinel Analytics Rule Coverage: run alongside to see enabled rules and MITRE ATT&CK gaps in Microsoft Sentinel
• Threat Hunting Readiness Baseline: run alongside to check retention and hunting readiness
• Defender Advanced Hunting Pack: run after to hunt with read-only KQL queries in Defender XDR
• Defender Incident Hygiene Review: run after to review the Defender XDR incident queue

Sources and compliance

• View MITRE ATT&CK framework coverage in Microsoft Sentinel 
• Proactively hunt for threats with advanced hunting in Microsoft Defender 
• Maps to Essential Eight regular review of detection coverage and to ISM controls for event logging and monitoring, supporting timely detection of cyber security incidents.
• ASD Essential Eight Maturity Model 

Licensed under CC BY 4.0  by EDUC4TE .

Last reviewed 2026-06-04