Purple › Module 8 › Lesson 1
Coverage Matrix
Coverage matrix literacy — ATT&CK tactic/technique rows, detection rule mapping, tested vs untested status — matrix on YOUR `$PURPLE_LAB`.
Visual · t35_coverage_matrix
Coverage matrix = named ATT&CK rows. $PURPLE_LAB. Original Cyberlium.
Opening
You cannot tune what you have not mapped — name coverage matrix rows on YOUR lab exercises before claiming enterprise ATT&CK coverage.
Coverage matrix literacy names: ATT&CK tactic column category, technique ID row category, detection rule mapping category, atomic test status category (tested/untested/N/A literacy stub), and last validated UTC category. Analyst builds coverage matrix stub on `$PURPLE_LAB` — minimum ten technique rows from Modules 6–7 exercises, rule ID cross-reference, honest tested status — without claiming prod coverage without data, without marking untested as green, without stranger org technique rows. Cyberlium teaches coverage vocabulary on YOUR notes — tuning foundation literacy. Refused: fabricated coverage, prod matrix without RoE, stranger org claims. Lab row: coverage matrix stub (ten techniques, rule mapping, status, UTC).
1. Named matrix rows
Tactic, technique ID, rule mapping, test status, last validated UTC — five literacy anchors.
Honest status — untested rows stay untested until atomic validates.
Command guide
Try these commands — Named matrix rows
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK Navigator (https://attack.mitre.org/resources/navigator/); MITRE ATT&CK (https://attack.mitre.org/); Elastic ATT&CK (https://www.elastic.co/guide/en/security/current/rules-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Rule cross-reference
Each technique links Module 4–5 rule ID — not orphan ATT&CK rows.
N/A stub documents why technique not in lab scope — not silent skip.
3. Refused
No fabricated tested status; no prod coverage claims without RoE data.
Matrix literacy supports tuning — not checkbox theater.
4. What you ship: coverage matrix stub
Ten technique rows + rule mapping + honest status + UTC + NEVER fabricated coverage line.
5. What you record before the next lesson
Coverage matrix stub path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark all ATT&CK techniques green tested without running any atomics on lab VM.
Right
Coverage matrix stub from `$PURPLE_LAB` exercises. Next: Gap Analysis.
Mission: coverage matrix stub
1) Name five matrix literacy rows. 2) Ten techniques from Modules 6–7. 3) Rule mapping and honest status each. 4) Write NEVER fabricated coverage line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “N/A row — minimum documentation literacy?”
Knowledge Check
APPLY: Coverage matrix literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Untested techniques may show as tested.
True or False
Knowledge Check
APPLY: Coverage matrix includes:
Multiple choice