Threat › Module 5 › Lesson 3
Coverage Gaps
Coverage gaps literacy identifies untested or undetected ATT&CK techniques — prioritize gaps from YOUR $TI_LAB Navigator mock and mapping table.
Visual · t33_coverage_gaps
Coverage gaps literacy. $TI_LAB only. Original Cyberlium.
Opening
Empty cells are homework — literacy names coverage gaps so purple teams and detection engineers prioritize on evidence, not assumptions.
Coverage gaps are ATT&CK techniques with weak or missing detection, logging, or emulation validation. Gap analysis compares Navigator layer scores against threat priorities — e.g., Initial Access gaps rank higher than obscure Impact subtechniques for most enterprises. Remediation routes to detection engineering, logging projects, or purple-team exercises. Cyberlium writes coverage gap list on YOUR $TI_LAB — three gaps from Navigator mock with remediation owner role. Next: Mapping Lab.
1. Gap analysis components (named)
Gap: technique ID with low Navigator score or missing data source. Priority: tied to threat intel requirements and actor targeting — fictional lab actor CYBERLIUM-RED on $TI_LAB. Remediation: new detection rule, log source deployment, purple-team test. Owner: detection engineering, hunt, or logging team role.
On $TI_LAB, write gap list — three techniques with priority, remediation type, and owner role.
Command guide
Try these commands — Gap analysis components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Navigator (https://mitre-attack.github.io/attack-navigator/); CISA (https://www.cisa.gov/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why gap literacy prevents checkbox ATT&CK programs
Coloring every cell green without rule links creates false confidence. Prioritized gaps align engineering sprint work to actual threat priorities. Feedback loop updates Navigator after remediation.
Students prioritize lab gaps on notes — production gap programs follow leadership risk appetite.
3. Lab boundary
Forbidden: marking full matrix covered without detection evidence. Allowed: coverage gaps card — three prioritized gaps from $TI_LAB Navigator mock with remediation notes.
Ship: coverage gaps card for YOUR lab review. Next: Mapping Lab.
4. What you ship: coverage gaps card for $TI_LAB
Three prioritized gaps with remediation and owner. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. Coverage gaps card. $TI_LAB named. File t33-m05-l03-coverage-gaps.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Claim zero gaps with no evidence. Prioritize obscure techniques over Initial Access without justification.
Right
Write coverage gaps card for YOUR $TI_LAB. Next: Mapping Lab.
Mission: prioritize coverage gaps on YOUR lab
1) List three gaps from Navigator mock. 2) Rank by fictional threat priority. 3) Assign remediation type and owner role. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Initial Access gaps usually outrank obscure subtechniques — justify priority with threat context.
Knowledge Check
APPLY: Coverage gap analysis identifies:
Multiple choice
Knowledge Check
APPLY: True or False: Gap remediation should assign an owner role such as detection engineering.
True or False
Knowledge Check
APPLY: Coverage gaps literacy on Cyberlium uses:
Multiple choice