-
Book Overview & Buying
-
Table Of Contents
Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition
By :
Detection on its own does not show what is missing. Individual alerts can confirm that certain activity is being identified, but they do not reveal whether entire areas of attacker behavior remain uncovered. The MITRE ATT&CK matrix (https://attack.mitre.org/) addresses this by providing a structured way to understand detection coverage across the attack lifecycle.
The matrix organizes attacker activity into tactics and techniques, representing how an attack progresses rather than focusing on isolated events. When detections are aligned to this model, they can be viewed in terms of which stages of an attack are visible and which are not. The focus moves from individual signals to overall coverage.
In Microsoft Sentinel, this alignment allows analytics rules to be associated with specific techniques. For example, if multiple detections are mapped to techniques under Initial Access and Credential Access, but no detections...