Skip to main content

Responses are generated using AI and may contain mistakes.

Outcomes NavigatorOutcomes Navigator Guide

Table of Contents

Assess Configuration Efficacy for a MITRE ATT&CK® Technique

Understand how well your environment is configured to protect against a specific MITRE ATT&CK® technique.

After you get a high-level view of your overall ATT&CK coverage, drill down to a specific technique under the Organizational Coverage tab. Find more resources about the technique, view the products you configured that provide data for related Exabeam applications and features, and learn what Exabeam applications and features your current configuration enables.[5]

To navigate to the Organizational Coverage tab, in Explore Exabeam Content Through These Portals, hover over a technique, then click See Details.

Choose an ATT&CK technique to assess

To choose a technique, under MITRE ATT&CK Tactic, select an ATT&CK tactic you want to assess or All tactics, then select a technique.

The View Outcomes by MITRE ATT&CK Tactics and Techniques page for the Account Manipulation ATT&CK technique, with the option to navigate to other techniques highlighted.

Summarize your configuration

At a glance, understand how well your environment is configured to protect against the ATT&CK technique:

The Organizational Coverage tab showing the detection summary for Account Manipulation.

  • Under MITRE Coverage, view the MITRE Coverage Score for the technique.

  • Under Coverage Over Time, view the MITRE Coverage Score for the technique over the past six months or weeks. To learn why your score may have increased or decreased, hover over the bar for that month or week. The chart updates at the end of each month or week. To toggle between weekly or monthly scores, click Last 6 months or Last 6 weeks.

    If you're comparing your coverage against that of other organizations in the MITRE ATT&CK® Coverage tab, you can also compare your MITRE Coverage Score for a specific technique against the average MITRE Coverage Score of other organizations for that technique.

    Each organization type you select appears as a separate line in the chart. A legend identifies which organization type is represented by which line in the chart:

    The Coverage Over Time chart with peer comparison.

    To view the relative change in the average MITRE Coverage Score over the last month for the organization type you selected, hover over a point in the line chart:

    Information about the relative change in the average MITRE Coverage Score compared to the previous period for the peer comparison organizations that appears when you hover a point in the Coverage Over Time chart.

  • Under Product Categories, view the number of recommended product categories for which you configured a product out of the total recommended product categories.

  • Under Resources, find resources, including what the technique is and an explainer on the ATT&CK framework.

  • Under Use Cases, view the Exabeam use cases to which the technique is related.

View the features your configuration enables

Under <ATT&CK Technique> Outcomes, view the Exabeam features and applications your configured products enable, including Dashboards, default and custom Advanced Analytics rules, correlation rules, and analytics rules.

For each feature, view how well your configuration enables the feature to address the given ATT&CK technique, also known as your coverage. The level of coverage from None to Best is calculated differently for each feature.

To view more details about what's enabled for each feature, click View <feature>. For example, to view which dashboards have all the data they need to be complete, click View Dashboards. For Advanced Analytics rules and Correlation Rules, you can also view whether rules are satisfied under the ALL FIELDS SEEN column, and whether the rule is enabled or disabled under the ENABLED column.

If you see gaps in your coverage, follow recommendations to improve your coverage directly in Outcomes Navigator. You can view recommendations only if you have a license that includes Advanced Analytics.

View configured products

Under ATT&CK Technique > Product Categories, view a table of the product categories you need to provide data for related Exabeam features and applications, sorted by importance. Under the Products Configured column, view the products you configured under each product category and their Parser Calibration Tier Average.



[5] MITRE ATT&CK and ATT&CK are trademarks of The MITRE Corporation ("MITRE"). Exabeam is not affiliated with or sponsored or endorsed by MITRE. Nothing herein is a representation of the views or opinions of MITRE or its personnel.