Take three threats from model to detection

applied · 70 min · Objective 1.8

Task

Apply objective 1.8: pick three threats from your STRIDE output, find the matching ATT&CK techniques, and determine for each whether you could actually detect it -- which is a data-source question before it is a rule question.

Steps

  1. Pick three accepted or mitigated threats with the largest blast radius and record them in lab/threat-to-detection.csv with header threat,technique_id,data_source,collected,coverage_pct,rule_exists,verdict.
  2. For each, name the ATT&CK technique and the DATA SOURCE that would show it -- process creation, authentication, network flow, cloud audit.
  3. Query your own log platform to determine whether that source is collected, and from what proportion of the lab. Put real numbers in coverage_pct.
  4. Write one detection rule for the threat with the best coverage, and TRIGGER it deliberately so you observe it fire.
  5. For the other two, write lab/detection-gaps.md stating the specific data source that would have to be collected and what it would cost.

Verify

awk -F, 'NR>1 && NF>=7 {n++} END {print n" threat(s) traced"}' lab/threat-to-detection.csv
awk -F, 'NR>1 && $5+0>0 {n++} END {print n+0" with measured coverage"}' lab/threat-to-detection.csv
grep -Eci 'fired|triggered|observed' lab/detection-gaps.md lab/threat-to-detection.csv 2>/dev/null
grep -Ec . lab/detection-gaps.md

Three threats traced with real coverage percentages, one rule observed firing, and the two gaps naming specific data sources. A coverage column of 100 with no query behind it is the claim the lesson warns about.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.