## 5 Results and Use Case
### SOC Coverage Gap Model Based on MITRE  
The MITRE ATT&CK framework contributes significantly to the detection capabilities of a Security Operations Center (SOC) in several ways, as it makes it clear for security analysts to understand adversary tactics, techniques, and procedures based on real-world examples and observations. Moreover, it enhances threat intelligence incident response and hunting capabilities by providing information about the attack behavior and the IoC associated with the attack vectors. MITRE attacks contribute to all the SOC sides by providing educational tools for SOC analysts and other cybersecurity professionals, providing a common language, understanding adversary behaviors, and encouraging the sharing of threat information and strategies for detection and response. This collaboration can lead to the development of more effective detection methodologies and a stronger collective defense against cyber threats. Overall, the MITRE ATT&CK framework is a valuable resource for SOCs to create or refine detection rules and analytics by simulating the behavior in their existing environment to improve the accuracy of the detection and reduce false positives. As we are measuring the SOC use case gap coverage based on MITRE ATT&CK framework and the existing organization's IT infrastructure, we need to provide a mapping of the tactics and techniques from MITRE to the existing device products on the company's side and answer the following questions:  
* What are the threats and risks based on the risk analysis? * Can we detect the tactics and techniques behavior based on the events coming from the onboard log sources? * How can we map the events to the events MITRE ATT&CK and identify gaps in our detection capabilities? First, we need to have clear insight into the tactics and techniques in the scope based on the understanding of the risks and potential threats against the critical assets. Our approach produces the mapping of the defensive artifacts using a hands-on methodology that is based on collecting the events generated from the device product on the existing IT infrastructure using adversary emulation tests. Other studies discussed the detection coverage of the security solutions based on MITRE, and those studies gathered information from the documentation and have no execution, which makes it approximate and contribute to the detection and not the SOC use case assessment and improvement. Table 3 shows the adapted methodology for developing defensive artifacts. The hands-on methodology is more appropriate when we are talking about use cases because it provides the exact pattern and artifact to answer the question of the capability to detect a specific behavior. Moreover, it gives the building blocks and the right patterns to implement the use case. This analysis provides clear visibility on what part is not well monitored and can represent blind spots in organizations' defensive controls. The identified gaps can be valuable information for the organization to prioritize investments in security solutions. Then, the logic of the rules takes place, which involves setting specific criteria with the patterns from the logs to trigger an alert for potential security threats. These rules are designed to identify unusual or malicious activity across an organization's digital environment by analyzing a vast amount of data from various sources, such as network devices, servers, applications, and security systems. A simple example is the scenario of having multiple failed login attempts followed by a successful login, which could indicate a brute-force attack. MITRE ATT&CK and Event ID Mapping Model for Coverage Analysis In our work, we aim to provide a comprehensive model to use MITRE ATT&CK and the existing organization's IT infrastructure to provide visibility on the use case coverage and the potential coverage level that may be granted by the right combination of the existing devices vendors and products with MITRE ATT&CK.