Gap Analysis

Detections → Gap Analysis identifies the specific points where your ATT&CK technique coverage and D3FEND defensive controls do not align. It cross-references the two frameworks using 305 technique-to-control mappings and surfaces the techniques that lack effective defense.

Open Gap Analysis

1. Go to Detections → Gap Analysis.

Filters and Export

Filters at the top let you narrow results by:

• Tactic — Filter by ATT&CK tactic (e.g., Initial Access, Lateral Movement)
• Priority — Filter by remediation priority (Critical, High, Medium, Low)
• Status — Tested or Untested

All filter state is synchronized with the URL, so filtered views can be bookmarked or shared. Open Export, then choose Export CSV or Export JSON.

Coverage Completeness

A donut chart visualizes how techniques break down across three coverage levels:

• Fully Covered — At least one mapped D3FEND control is deployed and rated Effective or Highly Effective
• Partially Covered — A D3FEND control is deployed but is not rated as effective
• No Coverage — No mapped D3FEND control is deployed

Gap Summary Statistics

A statistics panel breaks down gaps by remediation priority and by ATT&CK tactic, giving a quick view of where the largest concentrations of gaps exist.

Priority is calculated from prevalence weight and defense status:

Undefended Techniques Table

The main table lists every ATT&CK technique that lacks effective defensive coverage. Columns include:

• ATT&CK ID
• Technique Name
• Tactic
• Testing Status — Tested or Untested
• Outcome
• Missing D3FEND — Number of recommended D3FEND controls not effectively deployed
• Risk Score — 0-100 composite of prevalence weight, defense status, and test outcome
• Priority — Remediation priority level

Clicking a row opens a drawer for that technique: which D3FEND controls are recommended, their current presence and effectiveness status, and specific remediation guidance.

Ineffective Controls Table

A collapsible section below the main table lists D3FEND controls that are deployed but not performing effectively. Each entry shows:

• The D3FEND technique name and current effectiveness rating
• How many ATT&CK techniques it is supposed to protect against
• A recommended action: Tune (for Partially Effective controls) or Replace (for Ineffective controls)

Use this table to decide which controls to tune or replace.

Support

If the gap list looks empty on a live tenant, confirm hunts have run, then reach out to support@praetorian.com.