## 5 Results and Use Case
### SOC Coverage Gap Model Based on MITRE
During our interview with security experts from the SOC industry, we revealed that after identifying the risk and the objectives of the SOC, a request was made to have visibility on the whole organization's existing IT infrastructure, including the network topology, the critical assets, and the whole device's products and technologies. This information is used in the SOC engineering phase to define SOC architecture and the collection model. Moreover, the requested documentations are used to identify the log sources to be onboarded by priority and the logging standard to be applied on each log source for the Events Per Second EPS or device limitations imposed by the SIEM solution of choice. These files include the list of devices with at least the following details: * Device vendor; * Device product; * Version of the hardware and software; * Location; \begin{table}
\begin{tabular}{c c c} \hline \hline
**Name** & **Methodology** & **Description** \\ \hline \multirow{2}{*}{Hands-on} & Adversary emulation and & \multirow{2}{*}{Accurate} \\  & gather the logs. & \\ \multirow{2}{*}{Hands-off} & Document review and no & \\  & execution. & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Adapted methodology for developing defensive artifacts. * IP address and network information;
* The support group that is supposed to provide information and support. That information is delivered to the use case factory to ensure that the SOC can effectively implement the use case and confirm the logs source availability and quality (e.g., OS logs, network traffic, antivirus logs) are available to detect the tactics, techniques described in the use case and ensure the data are of high quality, with sufficient detail and reliability for effective analysis. Mapping the existing device products to MITRE ATT&ACK can provide insight into the use case coverage and gap. As per the literature review, this event mapping is carried out for Windows, and in our work, we make it clearer and attempt to do the same work for all the other device products. Our model can help the SIEM engineers and SOC experts to target the following gaps by automatically mapping the existing organization's IT technologies to MITRE ATT&CK:  
* Onboarding coverage gap: The log source is not onboard and not participating in any of the use cases;
* Logging standard configuration issues: Log source configuration errors or the logging standard not well configured on the log source, such as the severity and the priority for syslog;
* Use case definition: insufficient breadth of rules, rule logic errors, noisy rules. This process can be broken down into several key steps, each of which plays a crucial role in ensuring effective mapping and identification of potential security gaps. * **Phase 1:** Analysis of the existing organization's IT infrastructure. The initial step involves a thorough analysis of the existing IT infrastructure. This is achieved by utilizing inventory files, which provide detailed listings of all the devices connected to the network, including servers, routers, switches, and endpoints, alongside the details on the network topology diagrams, which provide a visual representation of the network's structure, showing how devices are interconnected. That information is the source of inputs for the proposed model as it provides the device technologies, products, and versions, and based on that information, we identify the list of events that could be generated by the log source. * **Phase 2:** Mapping device products and their events to MITRE ATT&CK. Once an understanding of the existing IT infrastructure is achieved, the next step involves mapping the device products and their specific event IDs to the MITRE ATT&CK techniques. This step involves mapping the events logged by the devices in response to the detection of the specific MITRE ATT&CK technique and tactic. After gathering the whole range of event IDs generated by every device product in response to every tactic and technique, a full mapping is performed to MITRE ATT&CK.