Skip to main content

Responses are generated using AI and may contain mistakes.

Outcomes NavigatorOutcomes Navigator Guide

Understand Your Overall MITRE ATT&CK® Coverage

To create a strategy for configuring your environment, get an overview of your overall MITRE ATT&CK® coverage in Outcomes Navigator.

After you select MITRE ATT&CK® as a framework to use in Outcomes Navigator, a MITRE ATT&CK® Coverage tab appears. Under this tab you can:[5]

Use this information to evaluate your overall security posture, which ATT&CK techniques are important to you, and what techniques you should focus on to achieve your goals.

Compare Coverage

To compare your coverage against the coverage of other organizations, specify the organization type under Peer Comparison.

You can select organizations by industry and organization size:

outcomesnavigator-mitreatt_ckcoverage-peercomparisoncriteria.png

You can compare your:

Summarize Your ATT&CK Coverage

Understand your overall ATT&CK coverage at a glance using the overall MITRE ATT&CK Coverage Score and Exabeam Nova MITRE ATT&CK Coverage Summary.

MITRE ATT&CK Coverage Score

Under MITRE ATT&CK Coverage Score:

The MITRE ATT&CK Coverage Score chart labelled with callouts and red rectangles.

1 View your current overall MITRE Coverage Score. The overall MITRE ATT&CK Coverage Score is an average of the MITRE Coverage Scores across all techniques. The overall MITRE ATT&CK Coverage Score is calculated once per day.

2 View the date range of the period depicted in the bar chart.

3 View the relative change in the overall MITRE ATT&CK Coverage Score since the last time the score was calculated.

4 To identify trends in the overall MITRE ATT&CK Coverage Score, you can view a bar chart depicting the overall coverage score over a period you specify: one month, three months, or six months:

outcomesnavigator-mitreatt_ckcoverage-timerangemenu.png

If you toggle the chart to depict the overall MITRE ATT&CK Coverage Score over three months or six months, each bar represents the average overall MITRE ATT&CK Coverage Score in a given month. If you toggle the chart to depict the overall MITRE ATT&CK Coverage Score over one month, each bar represents the average overall MITRE ATT&CK Coverage Score in a given week.

5 View the relative change in the overall MITRE ATT&CK Coverage Score over the specified period.

MITRE ATT&CK Coverage Score Peer Comparison

If you selected peer comparison criteria, you can compare your overall MITRE ATT&CK Coverage Score to the average overall MITRE ATT&CK Coverage Score of other organizations in MITRE ATT&CK Coverage Score.

Each organization type you select appears as a separate line in the chart. A legend identifies which organization type is represented by which line in the chart:

The MITRE ATT&CK Coverage Score chart with peer comparison.

To view the relative change in the average overall MITRE Coverage Score compared to the previous period for the organization types you selected, hover over a point in the line chart:

The MITRE ATT&CK Coverage Score chart showing the popover that appears when you hover over a point in the line.

Exabeam Nova MITRE ATT&CK Coverage Summary

The Exabeam Nova MITRE ATT&CK Coverage Summary is an AI-generated summary of your overall use case coverage.

The Exabeam Nova MITRE ATT&CK Coverage Summary.

The summary identifies:

  • The three techniques whose coverage score has increased the most

  • The three techniques whose coverage score has decreased the most

  • Recommendations for improving your coverage for those techniques whose coverage score has decreased

To view the summary in Exabeam Nova, click View Summary in Nova.

Explore ATT&CK Techniques by Coverage

To identify specific techniques of concern, view all techniques organized by tactic and the MITRE Coverage Score for each technique.

Matrix of all MITRE ATT&CK techniques organized by tacti under the Explore Exabeam Content Through These Portals MITRE ATT&CK Coverage tab.

For example, if your organization is concerned about Persistence, you might focus only on aligning your environment to the techniques under that tactic. If you want to get the most from Exabeam and maximize your protection, you should aim to protect against every technique you see.

To learn about what a specific technique is and get a summary of how well your environment protects against the technique, hover over the technique.

The details of the the Account Manipulation MITRE ATT&CK® technique that appear when you hover over the Account Manipulation ATT&CK technique in the Explore Exabeam Content Through These Portals MITRE ATT&CK Coverage tab.

To view more details about your coverage of the technique, click See Details. You're directed to the View Outcomes by MITRE ATT&CK® Tactics and Techniques > Organizational Coverage tab, where you can drill down into the configuration of your environment and how well it protects against the specific technique.

Hide a Technique

To focus on the most relevant threats to your organization, you can hide a technique. You might consider hiding techniques that have empty or incomplete data or aren't pertinent to your specific environment. Hidden techniques are excluded from the calculation for the overall MITRE ATT&CK Coverage Score.

To a hide a technique, hover over the technique, then click A blue eye..

To remove hidden techniques from view, toggle Show Hidden Techniques off.

The Show Hidden Techniques toggle is toggled off and highlighted in a red rectangle.

Filter ATT&CK Techniques

To focus on specific ATT&CK techniques of interest, you can filter the use cases by Coverage Score Factors Scores, the coverage scores for the Exabeam features and applications that cover the ATT&CK technique.

The Exabeam features and applications include analytics rules, correlation rules, and Dashboards.

outcomesnavigator-mitreatt_ckcoverage-coveragescorefactorsscoresfilter.png

Get Answers to Your Questions Using Exabeam Nova Advisor Agent

Get answers to any question about your security posture using the Exabeam Nova Advisor Agent. To navigate to Exabeam Nova Advisor Agent click Open Exabeam Nova.

The MITRE ATT&CK Coverage tab with the Open Exabeam Nova button highlighted in a red rectangle.

In Exabeam Nova Advisor Agent, enter a prompt, then press return or Enter or click A blue square with a white outline of a paper airplane in the center..

Consider asking questions about:

  • Your current overall ATT&CK coverage

  • How you can improve your current coverage of an ATT&CK tactic or technique

  • What content you can configure to improve your current coverage of an ATT&CK tactic or technique

  • What data sources you can configure to improve your current coverage of an ATT&CK tactic or technique

You can ask Exabeam Nova Advisor Agent about current coverage only. You can't ask about past coverage.



[5] MITRE ATT&CK and ATT&CK are trademarks of The MITRE Corporation ("MITRE"). Exabeam is not affiliated with or sponsored or endorsed by MITRE. Nothing herein is a representation of the views or opinions of MITRE or its personnel.