Use Case: Detection Engineering
Coverage gap analysis
Your team has 400 detection rules. ManySignal mapped them against ATT&CK and found that Defense Evasion — the tactic ransomware actors use most — has 33% coverage. Twelve high-priority gaps identified, all with suggested rules.
400 rules and still blind to half of ATT&CK
Security teams accumulate detection rules over years — each one written in response to an incident, a vendor recommendation, or a compliance requirement. The result is a rule estate with heavy coverage of some techniques (authentication anomalies, known malware hashes) and zero coverage of others (living-off-the-land execution, defense evasion via timestomping). The coverage is shaped by history, not by the current threat landscape.
ManySignal maps your entire detection estate against the MITRE ATT&CK matrix, producing an accurate picture of what you detect and what you miss. Coverage gaps are ranked by the prevalence of each technique in threat actor campaigns targeting your industry, so the highest-priority gaps are addressed first.
ATT&CK coverage by tactic
workflow: coverage_gap_analysis
inputs:
- rule_inventory: siem_rules + edr_policies + custom_detections
- attack_mapping: auto_classify + manual_tag_override
- data_sources: available_telemetry_catalog
- threat_profile: industry_sector_ttp_frequency
analysis:
- map: rule -> attack_technique(s)
- identify: uncovered_techniques (no rule maps here)
- filter: by available_data_sources (remove "uncoverable")
- rank: by threat_actor_frequency in your_industry
- suggest: rule_library_match for each gap
validation:
- synthetic_event: inject safe test for each covered technique
- confirm: rule fires (detection verified)
- flag: covered_in_theory_but_broken_in_practice
output:
- heatmap: attack_matrix colored by coverage_density
- gap_report: ranked list with rule suggestions
- validation_report: broken vs working detections
- trend: coverage_change week_over_weekTop coverage gaps this week
Coverage gap analysis FAQ
How does ManySignal map existing rules to MITRE ATT&CK techniques?
ManySignal ingests your detection rules (from SIEM, EDR, and custom sources) and maps each rule to the ATT&CK technique(s) it covers based on the rule logic, data sources, and configured tags. Rules that aren't already tagged are classified by ManySignal's rule analysis engine. The result is an ATT&CK heatmap showing which techniques have detection coverage and which are blind spots.
Does ManySignal suggest specific detection rules to fill coverage gaps?
Yes. For identified coverage gaps, ManySignal suggests detection rules from its library of 500+ pre-built detections, mapped to the specific ATT&CK technique. Suggestions are prioritized based on your industry's threat actor TTP profile — if ransomware groups targeting your sector commonly use a technique you don't cover, that gap is ranked highest.
Can ManySignal identify coverage gaps specific to my data sources?
Yes. Coverage gap analysis is constrained by your available data sources. If you don't collect process execution logs, techniques that require process telemetry are noted as 'uncoverable without source addition' rather than 'missing detection rule'. This prevents recommending rules that would never fire with your current data collection.
How does ManySignal validate that existing rules actually detect what they claim?
ManySignal provides adversary simulation validation: synthetic attack events (safe, non-destructive) are injected into your detection pipeline to verify that rules fire as expected. For each technique in the ATT&CK matrix, ManySignal can generate a test event and confirm whether your detection stack produces an alert. This identifies rules that are mapped correctly in theory but broken in practice.
Find the ATT&CK techniques your 400 rules don't cover
Industry-weighted coverage gap analysis with suggested rules and synthetic validation to close blind spots.