## 3 Related Work  
Although the relevance of SOC use case coverage and visibility for security planning and protection is widely recognized, research indicates that many organizations experience significant gaps in detection coverage [6]. According to a recent study by a pioneering firm in the threat coverage arena, these gaps often arise from issues such as log source configuration errors, malfunctioning log collectors, a lack of comprehensive rules, erroneous rules, and excessively noisy rules, which collectively degrade the security posture of the typical organization. Another study underscores the necessity for SOC teams to continually refine their methodologies to keep pace with rapidly evolving adversarial tactics, as highlighted by the continuous updates to the ATT&CK framework [19]. This framework assists SOC teams in prioritizing critical areas of focus and identifying vulnerabilities within security infrastructures. The ATT&CK model, with its detailed breakdown of techniques, tactics, and procedures, serves as a crucial tool for prioritizing threat mitigation and identifying security deficiencies. The Cybersecurity and Infrastructure Security Agency (CISA) offers guidance that aids analysts in precisely and consistently mapping adversary behaviors to applicable ATT&CK techniques within cyber threat intelligence (CTI) operations [20]. Successful implementation of ATT&CK is expected to yield precise and consistent mappings that contribute to the development of adversary profiles, the analysis of activity trends, and the enhancement of detection, response, and mitigation strategies [21]. Furthermore, other scholarly contributions utilize the MITRE ATT&CK framework for threat modeling and simulating adversary behaviors [22], generating a suite of visualizations based on the Common Attack Pattern Enumeration and Classification (CAPEC) [23] and the Common Vulnerabilities and Exposures (CVE) standards [24]. These visualizations directly link to enterprise mitigation strategies endorsed by the MITRE ATT&CK framework, emphasizing a strategic synthesis of vulnerability management, threat modeling, and the application of compensating controls. This integrative approach, as proposed by MITRE, establishes a critical linkage between identifying vulnerabilities, modeling potential threats, and implementing effective security controls. The detection coverage gap is large at many organizations due to many actors, as suggested by [25], and explains that there are more things involved in obtaining and, especially, keeping your detection coverage map current and asked some questions about how to systematically approach the detection coverage in the SOC regarding the data collection, processing, and rules configuration alongside the threat assessment. Other works conducted the mapping of Windows event IDs to MITRE attacks to provide visibility on the coverage based on the event gathered from Windows log sources, such as [26], but it does not cover the full coverage map using the other technologies. On the other hand, in his report [27], [PERSON] conducted a detection gap analysis based on MITRE ATT&CK and the security products on the existing IT infrastructure using reports and documentation of the solution capabilities from their official websites. This study exploited only the security solutions on their model and did not cover every log source on the existing IT infrastructure, and they did not use the low-level mapping using patterns and the event IDs generated from the log sources. Recent studies have explored the integration of SIEM tools with the MITRE ATT&CK framework to enhance SOC operations. [PERSON] et al. [28] highlighted how aligning SIEM detection rules with MITRE ATT&CK tactics and techniques significantly improves threat detection. By mapping event logs to specific ATT&CK techniques such as Credential Dumping (T1003), SIEM systems like Elastic SIEM and IBM QRadar enhance SOCs' ability to identify and respond to advanced threats in real time.