Chapter 19 — Authorized offensive security and red team: monitoring
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Coverage as a conversation"]
N2["19.2 Alerted, logged, missed"]
N3["Lab G — coverage matrix"]
N4["19.3 From miss to backlog"]
N5["19.4 Navigator and D3FEND"]
N6["19.5 Retesting the same cells"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Coverage as a conversation"]
N2["19.2 Alerted, logged, missed"]
N3["Lab G — coverage matrix"]
N4["19.3 From miss to backlog"]
N5["19.4 Navigator and D3FEND"]
N6["19.5 Retesting the same cells"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Coverage as a conversation]
|
v
[19.2 Alerted, logged, missed]
|
v
[Lab G — coverage matrix]
|
v
[19.3 From miss to backlog]
|
v
[19.4 Navigator and D3FEND]
|
v
[19.5 Retesting the same cells]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) build an ATT&CK coverage matrix from a purple-team log; (2) interpret alerted, logged and missed outcomes; (3) propose one detection improvement per missed technique; (4) keep the matrix scoped to the exercise.
19.1 Coverage as a conversation
A coverage matrix does not claim the organisation detects "everything". It shows, for the techniques exercised in a named window, whether the SOC alerted, merely logged, or missed. That conversation drives investment.
TRT's coverage slides open with the window dates and the list of techniques exercised, so the matrix cannot be read as a statement about everything. Any claim of universal detection is deleted in review, because seven techniques in one night cannot support it. Discussions about investment then use the three words alerted, logged and missed, which point directly to what needs to be built.
19.2 Alerted, logged, missed
Alerted means a person or playbook was notified in time to act. Logged means the telemetry existed but nobody was woken. Missed means the behaviour left no usable telemetry. Logged is not success if the exercise assumed a responding analyst.
SOC leaders sometimes read logged as partly working, so Priya explains it against the exercise goal. If the exercise assumed an analyst would respond, a technique that was only logged counts as a miss for that goal. It still opens a DET ticket, even though the telemetry existed, because nobody acted in time.
Lab G — coverage matrix
"""Lab G (ch 19): ATT&CK technique coverage matrix from a synthetic purple-team log."""
log = [
("T1078", "Initial Access", "alerted"), ("T1133", "Initial Access", "logged"),
("T1087", "Discovery", "missed"), ("T1069", "Discovery", "alerted"),
("T1021", "Lateral Movement", "missed"), ("T1213", "Collection", "logged"),
("T1567", "Exfiltration", "alerted"),
]
order = ["alerted", "logged", "missed"]
for tid, tactic, outcome in log:
print(f"{tid:6} {tactic:17} " + " ".join("X" if o == outcome else "." for o in order))
n = len(log)
for o in order:
k = sum(1 for _, _, x in log if x == o)
print(f"{o:8} {k}/{n} = {100 * k / n:.1f}%")
Run with python3 lab_coverage.py. Verified output:
T1078 Initial Access X . .
T1133 Initial Access . X .
T1087 Discovery . . X
T1069 Discovery X . .
T1021 Lateral Movement . . X
T1213 Collection . X .
T1567 Exfiltration X . .
alerted 3/7 = 42.9%
logged 2/7 = 28.6%
missed 2/7 = 28.6%
19.3 From miss to backlog
Each missed technique becomes a backlog item: which log source, which alert logic, which owner, which test to prove it later. Tie the item to the ATT&CK ID so future exercises can retest the same cell.
DET-19 and DET-20 follow this pattern for T1021 and T1087: each names the log source, the alert logic, an owner and a retest plan. The ATT&CK tag lets the next purple cycle find the same cell. A miss recorded without a tag tends to land in the wrong queue and is never retested.
19.4 Navigator and D3FEND
ATT&CK Navigator visualises coverage layers. D3FEND names defensive techniques that can counter a given offensive technique. Together they help a technologist talk to both red and blue without inventing a private vocabulary.
Priya imports the set of techniques actually exercised in ENG-712 into Navigator rather than displaying a generic enterprise heat map. D3FEND links sit on the cells where a recommendation is made. A heat map that does not reflect the exercised set is rejected as decoration, because it suggests coverage nobody measured.
19.5 Retesting the same cells
A coverage matrix earns its keep only if the next exercise reopens the same cells. Priya tags DET-19 and DET-20 with T1021 and T1087 so the following purple cycle can print a before/after row. Without that discipline the organisation rediscovers the same misses and calls it a new insight.
Exercising new and interesting techniques does not excuse skipping the cells that missed last time. If those rows still show a miss, the backlog items are reopened with their owners.
Worked example
TRT's purple log covers seven techniques. Three alerted (42.9%), two logged (28.6%), two missed (28.6%). The misses are T1087 Account Discovery and T1021 Remote Services. Priya opens two backlog tickets: directory audit logging to the SIEM for T1087, and jump-host session alerts for T1021.
Synthetic case. The seven-technique log and percentages are invented.
Errors and limits
A matrix from one exercise is not an enterprise maturity score. Do not hide misses to protect feelings; the learning is the product.
Exercises
- EX055 — Percentages. Quote the three outcome percentages printed by the lab. Rubric: 3 = alerted 42.9%, logged 28.6%, missed 28.6%; 2 = two correct; 1 = one; 0 = none.
- EX056 — Backlog item. Write a backlog ticket title for the T1021 miss. Rubric: 3 = names T1021 + detection/alert goal + system (jump host/remote services); 2 = vague detection ticket; 1 = "try harder"; 0 = none.
- EX057 — Logged ≠ done. Why is a "logged" outcome for T1133 not enough if the exercise expected a responding analyst? Rubric: 3 = telemetry without notification/response fails the detect-and-respond goal; 2 = partial; 1 = logged is success; 0 = none.
Synthesis
Measure what this exercise exercised, tell the truth about misses, and turn each miss into a named detection task.
Continue studying — chapter 19 of 30
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →