A transit SOC heatmap in Enterprise Security shows ATT&CK technique coverage from enabled correlation searches. What actually produces that coverage view?
Select an answer to reveal the explanation.
Short Explanation
A heatmap is not a sticker you buy. Coverage lights up when annotated detections are on and the sourcetypes they need are actually flowing. An add-on with no content, a renamed dashboard, or a CIM job named ATT&CK will not paint the map.
Full Explanation
ATT&CK coverage views in Enterprise Security reflect enabled correlation searches that are annotated to techniques and that have the supporting data. Installing a reference add-on without detections or telemetry does not create coverage. CIM acceleration speeds tstats on data models; it is not itself an ATT&CK heatmap. Renaming Security Posture does not annotate detections or onboard data.