Skip to main content

Responses are generated using AI and may contain mistakes.

Outcomes NavigatorOutcomes Navigator Guide

Understand Your Overall MITRE ATT&CK® Coverage

To create a strategy for configuring your environment, get an overview of your overall MITRE ATT&CK® coverage in Outcomes Navigator.

After you select MITRE ATT&CK® as a framework to use in Outcomes Navigator, a MITRE ATT&CK® Coverage tab appears. Under this tab you can:

The MITRE ATT&CK Coverage tab in Outcomes Navigator.

Use this information to evaluate your overall security posture, which ATT&CK techniques are important to you, and what techniques you should focus on to achieve your goals.

Summarize Your ATT&CK Coverage

Understand your overall ATT&CK coverage at a glance using the overall MITRE ATT&CK Coverage Score and Exabeam Nova MITRE ATT&CK Coverage Summary.

MITRE ATT&CK Coverage Score

Under MITRE ATT&CK Coverage Score:

The MITRE ATT&CK Coverage Score chart labelled with callouts and red rectangles.

1 View which version of the ATT&CK framework Outcomes Navigator is using.

2 View your current overall MITRE Coverage Score. The overall MITRE ATT&CK Coverage Score is an average of the MITRE Coverage Scores across all techniques. The overall MITRE ATT&CK Coverage Score is calculated once per day.

3 View the date range of the period depicted in the bar chart.

4 View the relative change in the overall MITRE ATT&CK Coverage Score since the last time the score was calculated.

5 To identify trends in the overall MITRE ATT&CK Coverage Score, you can view a bar chart depicting the overall coverage score over a period you specify: one month, three months, or six months.

If you toggle the chart to depict the overall MITRE ATT&CK Coverage Score over three months or six months, each bar represents the average overall MITRE ATT&CK Coverage Score in a given month. If you toggle the chart to depict the overall MITRE ATT&CK Coverage Score over one month, each bar represents the average overall MITRE ATT&CK Coverage Score in a given week.

6 View the relative change in the overall MITRE ATT&CK Coverage Score over the specified period.

7 Compare your overall MITRE Coverage Score against the average MITRE Coverage Score of other organizations. You can select organizations by industry and organization size:

Peer comparison selection criteria.

Each organization type you select appears as a separate line in the chart. A legend identifies which organization type is represented by which line in the chart:

The MITRE ATT&CK Coverage Score chart with peer comparison.

To view the relative change in the average overall MITRE Coverage Score compared to the previous period for the organization types you selected, hover over a point in the line chart:

The MITRE ATT&CK Coverage Score chart showing the popover that appears when you hover over a point in the line.

Exabeam Nova MITRE ATT&CK Coverage Summary

The Exabeam Nova MITRE ATT&CK Coverage Summary is an AI-generated summary of your overall use case coverage. To view the entire summary, click View entire summary.

The ​​Exabeam Nova MITRE ATT&CK Coverage Summary​​.

The summary identifies:

  • The three techniques whose coverage score has increased the most

  • The three techniques whose coverage score has decreased the most

  • Recommendations for improving your coverage for those techniques whose coverage score has decreased

Explore ATT&CK Techniques by Coverage

To identify specific techniques of concern, view all techniques organized by tactic and the MITRE Coverage Score for each technique.

Matrix of all MITRE ATT&CK techniques organized by tacti under the Explore Exabeam Content Through These Portals MITRE ATT&CK Coverage tab.

For example, if your organization is concerned about Persistence, you might focus only on aligning your environment to the techniques under that tactic. If you want to get the most from Exabeam and maximize your protection, you should aim to protect against every technique you see.

To learn about what a specific technique is and get a summary of how well your environment protects against the technique, hover over the technique.

The details of the the Account Manipulation MITRE ATT&CK® technique that appear when you hover over the Account Manipulation ATT&CK technique in the Explore Exabeam Content Through These Portals MITRE ATT&CK Coverage tab.

To view more details about your coverage of the technique, click See Details. You're directed to the View Outcomes by MITRE ATT&CK® Tactics and Techniques > Organizational Coverage tab, where you can drill down into the configuration of your environment and how well it protects against the specific technique.

Hide a Technique

To focus on the most relevant threats to your organization, you can hide a technique. You might consider hiding techniques that have empty or incomplete data or aren't pertinent to your specific environment. Hidden techniques are excluded from the calculation for the overall MITRE ATT&CK Coverage Score.

To a hide a technique, hover over the technique, then click A blue eye..

To remove hidden techniques from view, toggle Show Hidden Techniques off.

The Show Hidden Techniques toggle is toggled off and highlighted in a red rectangle.

Get Answers to Your Questions Using Exabeam Nova Advisor Agent

Get answers to any question about your security posture using the Exabeam Nova Advisor Agent. To navigate to Exabeam Nova Advisor Agent click Open Exabeam Nova.

The MITRE ATT&CK Coverage tab with the Open Exabeam Nova button highlighted in a red rectangle.

In Exabeam Nova Advisor Agent, enter a prompt, then press return or Enter or click A blue square with a white outline of a paper airplane in the center..

Consider asking questions about:

  • Your overall ATT&CK coverage

  • How you can improve your coverage of an ATT&CK tactic or technique

  • What content you can configure to improve your coverage of an ATT&CK tactic or technique

  • What data sources you can configure to improve your coverage of an ATT&CK tactic or technique



[5] MITRE ATT&CK and ATT&CK are trademarks of The MITRE Corporation ("MITRE"). Exabeam is not affiliated with or sponsored or endorsed by MITRE. Nothing herein is a representation of the views or opinions of MITRE or its personnel.