MITRE ATT&CK as a Common Language

• ATT&CK gives detection teams a common topo in which 'coverage' and 'gaps' are discussable, not vibes.
• Incident reports, tooling, and threat intel all cite technique IDs — fluency is tablestakes for SOC work.
• Coverage matrices turn 'we should detect more' into a concrete, prioritized list.

You cannot respond to a play you never scouted; ATT&CK is your scout team's notebook of every known move.

• Tactics: columns like InitialAccess, Execution, PrivilegeEscalation, Exfiltration — the phase of the operation.
• Techniques: rows like T1059 Command & Scripting, each with sub-techniques and platform relevance.
• Groups/campaigns attach real TTPs to named adversaries, so defenders learn the patterns that actually get used.
• Analysts map their detections onto the matrix cell-by-cell to expose the uncovered floors.

• A SOC fills a coverage matrix for their top five tactics and finds Execution fully blind; the next quarter's roadmap writes itself.
• A detection team cites 'T1566 phishing' with sub-technique IDs in every incident review and board deck.
• A red team reports findings by technique so defenders see the exact move, not a flavor text.

• Focus mapping on the tactics/techniques relevant to your estate's likely adversaries, not the full matrix.
• Keep the map current: add coverage when a technique you lack is used in a new incident.
• Use technique IDs in tickets, rules, and reports for cross-team precision.
• Pair ATT&CK with threat intel: framework yields 'where', intel yields 'who'.

• Filling every cell of the matrix with 'covered' from one over-broad rule — coverage means a detection that fires for it.
• Chasing the latest group chain instead of the persistent gaps on your own top-five tactics.
• Treating ATT&CK as a checklist of things to block, not a map of what to observe.
• Using technique IDs in prose but never in the alerts themselves, so the map rots.

• When an incident is graded against the matrix, pull the technique's detection requirement and compare with what fired.
• Attribute each alert to its ATT&CK cell in SOC-style dashboards; a covered-but-quiet cell is a probe.
• Re-run the gap review after every big incident — the event that escaped is your newest gap.

• The framework is defense vocabulary, not attack instruction; keep technique detail relevant to detection, not adversarial tuition.
• Share coverage maps only with parties who need them; they reveal what you can and cannot see.