Putting Detection Coverage to the Test: A Windows Security Case Study
A case study of 144 Sigma analytics using Windows Security log sources shows why ATT&CK mappings alone do not reveal the depth or quality of detection coverage.
Beyond the Heatmap: A New Way to Measure Detection Coverage
Summiting the Pyramid introduces implementation coverage and detection quality to help defenders measure the depth and effectiveness of detection coverage beyond an ATT&CK heatmap.