## 5 Results and Use Case
### SOC Coverage Gap Model Based on MITRE
Table 4 shows an example of the mapping of some Windows events to some MITRE ATT&CK techniques. The mapping is performed for every technique, as shown in Table 5 below, which describes the mapping of Windows events to the Initial access technique on the MITRE ATT&CK matrix. * **Phase 3:** Establishing coverage and identifying gaps. By mapping all the relevant events IDs and logs from all the technologies to MITRE ATT&CK matrix, we can reveal the real coverage we can achieve based on what we are having and compare it with the current implemented use cases in the same context, as shown in Figure 6.  
Figure 7 below shows another mapping based on CISCO Firepower logs and network discovery technique. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**ATT\&CK** & **ATT\&CK** & **Description** & **Device** & **Device** & **Event ID** & **Used in** \\
**Tactic** & **Technique** & & **Vendor** & **Product** & **Product** & **Use-Case Logic** \\ \hline \multirow{4}{*}{TA0001—Initial Access} & T1078.002- & \multirow{4}{*}{Login failure from a} & \multirow{4}{*}{Microsoft} & \multirow{4}{*}{Windows} & \multirow{4}{*}{33205} & \multirow{4}{*}{Yes} \\  & Valid & & & & & \\ \cline{1-1}  & accounts & & & & & \\ \cline{1-1}  & & & & & \\ \cline{1-1}  & accounts & & & & & \\ \cline{1-1} TA0002— Execution & T1053.005- & \multirow{4}{*}{Cheduled Task} & Persistent scheduled & \multirow{4}{*}{Microsoft} & \multirow{4}{*}{Windows} & \multirow{4}{*}{4688} & \multirow{4}{*}{Yes} \\  & Scheduled Task & & & & & \\ \cline{1-1} TA0006— & T1558.001- & \multirow{4}{*}{Credential Access} & & & & \\ \cline{1-1}  & Golden Ticket & potential Golden ticket & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Example mapping of Windows events to MITRE ATT&CK techniques. Figure 6: Mapping of Windows event ID to MITRE ATT&CK initial access technique. \begin{table}
\begin{tabular}{c c} \hline \hline
**Initial Access Technique** & **Windows Event IDs** \\ \hline Exploit Public-Facing Application (T1190) & 4624, 4625, 4628, 4698, 5156, 4637, 7031, 7036 \\ Drive-by Compromise (T1189) & 4688, 4104, 4657, 5156, 1123, 7030, 7045, 1102 \\ Content Injection (T1059) & 4688, 4104, 4657, 4636, 5156, 7036, 7045 \\ External Remote Services (T1133) & 4624, 4625, 4648, 4776, 4769, 4768, 4673, 5140 \\ Replication Through Removable Media (T1091) & 4634, 4656, 4660, 4688, 7036, 7030, 7045, 1102 \\ Supply Chain Compromise (T1195) & 4688, 7045, 7030, 4657, 4719, 1102, 4776, 4769, \\  & 4673, 4767, 4624, 5140 \\ Valid Accounts (T1078) & 4624, 4672, 4720, 4722 \\ Domain Accounts & 4624, 4768, 4769, 4776, 4672 \\ Local Accounts & 4624, 4625, 4648, 4769, 4768, 4673, 5140 \\ Trusted Relationship (T1199) & 4624, 4625, 4648, 4769, 4768, 4673, 5140 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Microsoft Windows event ID mapping to initial access on MITRE ATT&CK. To have full visibility on the coverage, we need to make the same work with all the existing technologies and devices products on the organization infrastructure with very MITRE attack technique to check whether we can cover it or not and build a coverage dashboard that rates every technique as follows:  
* Already covered: if there is a rule in place to detect the attack technique using at least one of the device products on the existing IT infrastructure;
* Gap: this means that the attack technique is not covered and has two subcategories:  
We have the requirements and the event IDs to build the rule to detect the attack technique;  
We do not have a specific log source to detect the target behavior. Following the categorization logic, we can build a use case coverage dashboard and provide clear visibility on the gap and whether we can use the existing technologies to improve the detection capabilities.