Gap Analysis

Detections → Gap Analysis identifies the specific points where your ATT&CK technique coverage and D3FEND defensive controls do not align. It cross-references the two frameworks using 334 technique-to-control mappings and surfaces the techniques that lack effective defense.

Open Gap Analysis

1. Go to Detections → Gap Analysis.

Filters and Export

Filters at the top let you narrow results by:

• Tactic — Filter by ATT&CK tactic (e.g., Initial Access, Lateral Movement)
• Priority — Filter by remediation priority (Critical, High, Medium, Low)
• Testing Status — Filter by whether a technique has been tested or not

All filter state is synchronized with the URL, so filtered views can be bookmarked or shared. The tab supports exporting the current filtered view to CSV or JSON format.

Coverage Completeness

A donut chart visualizes how techniques break down across three coverage levels:

• Fully Covered — At least one mapped D3FEND control is deployed and rated Effective or Highly Effective
• Partially Covered — A D3FEND control is deployed but is not rated as effective
• No Coverage — No mapped D3FEND control is deployed

Gap Summary Statistics

A statistics panel breaks down gaps by remediation priority and by ATT&CK tactic, giving a quick view of where the largest concentrations of gaps exist.

Priority is calculated from prevalence weight and defense status:

Undefended Techniques Table

The main table lists every ATT&CK technique that lacks effective defensive coverage. Columns include:

• ATT&CK ID and Name
• Tactic
• Tested / Outcome — Whether the technique was tested and what happened
• Missing Defense Count — Number of recommended D3FEND controls not effectively deployed
• Risk Score — 0-100 composite of prevalence weight, defense status, and test outcome
• Priority — Remediation priority level

Clicking a row opens a Detail Drawer that shows the full context for that technique: which D3FEND controls are recommended, their current presence and effectiveness status, and specific remediation guidance.

Ineffective Controls Table

A collapsible section below the main table lists D3FEND controls that are deployed but not performing effectively. Each entry shows:

• The D3FEND technique name and current effectiveness rating
• How many ATT&CK techniques it is supposed to protect against
• A recommended action: Tune (for Partially Effective controls) or Replace (for Ineffective controls)

This table helps teams prioritize where to invest tuning effort for the greatest return in coverage improvement.

Support

If the gap list looks empty on a live tenant, confirm hunts have run, then reach out to support@praetorian.com.