Innomerc Choose your depth. Learn at your own pace.
Understand it
A detection is a way to notice behavior worth reviewing. Giving it an ATT&CK technique label explains what behavior it aims to cover; the label does not prove it works in your environment.
Useful coverage needs relevant events, an analytic that handles them and people or automation able to respond. If logs are missing, a rule cannot inspect them.
Under the hood
A coverage claim should specify platform, behavior variant, required data, collection configuration and test evidence. Data quality includes field presence, delay, time alignment and retention. A rule may work on one event source while failing on another.
Practitioner perspective
Record analytic version, telemetry contract, validated procedure, expected result, known blind spots and false-positive handling. Re-test after collection or platform changes. ATT&CK is descriptive knowledge; tactic coverage percentages can hide large differences between behavior variants.
For a fictional forwarding-rule detection, verify creation and modification audit events, identity correlation, approved delegation exceptions and response ownership. Do not publish an untested threshold as a production rule. Report unknown coverage explicitly.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Rule labelled
An analytic receives a technique label.
Read every step without animation
Mapping only
- Rule labelled. An analytic receives a technique label.
- Logs absent. Required events are not collected.
- Blind spot. The analytic cannot see the behavior.
The label is not evidence of collection.
Validated visibility
- Telemetry checked. Confirm required fields and coverage.
- Test performed. Exercise an authorized representative procedure.
- Limits recorded. Document outcome, exceptions and blind spots.
Coverage is a bounded evidence claim.
Attack view
A dashboard shows a technique as covered although required audit logging is disabled on important systems.
Defender view
- Validate telemetry before relying on a mapping.
- Test representative behaviors and document unsupported variants.
Common mistakes
- A green technique cell does not prove every variant is detectable.
- No alerts does not prove no attacks occurred.
Check your understanding
Active recall: explain this idea in 30 seconds
A detection is a way to notice behavior worth reviewing. Giving it an ATT&CK technique label explains what behavior it aims to cover; the label does not prove it works in your environment.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.