An IR analyst opens an ATT&CK Navigator layer mapped to MITRE ATT&CK techniques. Each technique is shaded by detection coverage: dark red means no telemetry, amber means partial, green means full. During a ransomware tabletop, the analyst wants to know where to improve logging first. Which finding should the analyst prioritize?
Select an answer to reveal the explanation.
Short Explanation
Think of the Navigator like a weather map for your detections: dark red means blind spots, not just rough forecasts. You want to fix the spots with no telemetry first, because partial coverage at least gives you a clue. Don’t chase green or amber unless the mission is tuning, not closing gaps.
Full Explanation
An ATT&CK Navigator layer visualizes detections, controls, or telemetry against MITRE ATT&CK techniques. When colors represent detection coverage, absence of coverage is the highest-priority gap because an adversary using that technique can operate without leaving evidence in monitored data sources. This supports incident-response goals of reducing dwell time and ordering the detection-engineering backlog.
Partial coverage can be useful for tuning or correlation logic, but it is not the primary gap when the objective is to improve logging first. Full coverage does not indicate a detection gap; it may still produce noise, but noise reduction is a separate quality improvement. Techniques outside the layer may simply be out of scope for the current mapping, not necessarily missing detections, so they cannot be prioritized without confirming the layer’s scope and data sources.
Exam caveat: The exam expects you to read the layer’s legend and map each color to the stated coverage meaning rather than assuming all colored techniques are equally urgent. Operational check: Export the layer, filter for the no-coverage color, and validate each technique against SIEM, EDR, and NetFlow sources before assigning a detection backlog ticket.