Skip to content

Visibility scoring

Jump to bottom
Marcus Bakker edited this page Jul 8, 2019 · 6 revisions

DeTT&CT describes 5 scores for visibility. A score may not always be a perfect fit. Use the score that fits best. The scores are explained in the table below: visibility score. This scoring table is also included in the following Excel file: scoring_table.xlsx.

Visibility scores

Score Score name Description
0 None No visibility at all.
1 Minimal Sufficient data sources with sufficient quality available to be able to see one aspect of the technique's procedures.
2 Medium Sufficient data sources with sufficient quality available to be able to see more aspects of the technique's procedures compared to "1/Minimal".
3 Good Sufficient data sources with sufficient quality available to be able to see almost all known aspects of the technique's procedures.
4 Excellent All data sources and required data quality necessary to be able to see all known aspects of the technique's procedures are available.

Overview

  1. Home
  2. Introduction
  3. Installation and requirements
  4. Getting started / How to
  5. Changelog
  6. Future developments
  7. ICS - Inconsistencies

Data sources

  1. Introduction
  2. DeTT&CT data sources
  3. Data sources per platform
  4. Data quality
  5. Scoring data quality
  6. Improvement graph

Visibility Coverage

  1. Introduction
  2. Scoring visibility
  3. Improvement graph

Detection coverage

  1. Introduction
  2. Scoring detection
  3. Improvement graph

Threat actor group mapping

  1. Introduction

YAML administration files

  1. Introduction
  2. Data sources
  3. Techniques
  4. Groups
  5. DeTT&CT Editor
Clone this wiki locally