How do I find gaps in my use cases framework with ATT&CK Intelligence View?

Export ATT&CK TIDs your SIEM rules, Sigma library, or detection catalog documents as covered into a TID column, filter the matrix to the same scope as your framework assessment, then Import → Compare TIDs with Current Filter. In view only (blue) highlights in-scope techniques missing from your framework—the primary backlog signal.

How do I evaluate my SOC with six months of alert TIDs?

Export distinct ATT&CK technique IDs from alerts over six months into a TID column, scope the matrix with Platform and Tactic filters, then Import → Compare TIDs with Current Filter. Red highlights show triggered techniques in scope; blue shows in-scope techniques that never mapped to an alert.

How do I compare SIEM alert TIDs with ATT&CK Intelligence View?

Export distinct technique IDs from alerts into a TID column, set platform/tactic filters to your SOC scope, then Compare TIDs with Current Filter without changing filters.

What does blue highlight mean in TID comparison?

Blue means In view only: the technique is in your current scoped view but not in your uploaded file—in-scope blind spots where your SOC did not trigger an alert in the review window.

What does yellow highlight mean in TID comparison?

Yellow means In file only: the TID triggered in your SIEM export but is outside the current filtered view—often scope mismatches or parent vs sub-technique mapping issues.

Can I audit detection framework or use cases coverage with this workflow?

Yes. Upload your use cases framework TID list (Sigma, SIEM catalog, EDR pack), apply the same filters as your assessment, and use In view only (blue) gaps to prioritize new rules. Click View report for the A4 PDF or export Excel for audit evidence.

How do I compare BAS results to documented detection coverage?

Use Import → Compare Two TID Sheets. Name the first list (e.g. your use-case catalog) and the second (e.g. BAS executed TIDs), upload each file or one workbook, click Compare lists, then View report for the A4 PDF. Only in second list (yellow) = emulated techniques missing from documentation; match % summarizes overlap for exercise readouts.

What is the difference between Framework Gap Analysis and Two-Sheet Comparison?

Framework Gap Analysis compares one uploaded file against your filtered matrix view and updates when filters change. Two-Sheet Comparison compares two named TID lists directly with no filter dependency. See the Two-Sheet TID Comparison guide for the full comparison table.

ATT&CK Intelligence View

ATT&CK Intelligence View — a community-focused MITRE ATT&CK matrix explorer with connected filters, detection strategies, D3FEND mappings, and technique intelligence. Compare with the official MITRE ATT&CK® Navigator in the guide.