Purple › Module 8 › Lesson 1
Coverage Matrix
Coverage matrix literacy — ATT&CK tactic/technique rows, detection rule mapping, tested vs untested status — matrix on YOUR `$PURPLE_LAB`.
Visual · t35_coverage_matrix
Coverage matrix = named ATT&CK rows. $PURPLE_LAB. Original Cyberlium.
Opening
You cannot tune what you have not mapped — name coverage matrix rows on YOUR lab exercises before claiming enterprise ATT&CK coverage.
Coverage matrix literacy names: ATT&CK tactic column category, technique ID row category, detection rule mapping category, atomic test status category (tested/untested/N/A literacy stub), and last validated UTC category. Analyst builds coverage matrix stub on `$PURPLE_LAB` — minimum ten technique rows from Modules 6–7 exercises, rule ID cross-reference, honest tested status — without claiming prod coverage without data, without marking untested as green, without stranger org technique rows. Cyberlium teaches coverage vocabulary on YOUR notes — tuning foundation literacy. Refused: fabricated coverage, prod matrix without RoE, stranger org claims. Lab row: coverage matrix stub (ten techniques, rule mapping, status, UTC).
1. Named matrix rows
Tactic, technique ID, rule mapping, test status, last validated UTC — five literacy anchors.
Honest status — untested rows stay untested until atomic validates.
Command guide
Try these commands — Named matrix rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK Navigator — https://attack.mitre.org/resources/navigator/ MITRE ATT&CK — https://attack.mitre.org/ Elastic ATT&CK — https://www.elastic.co/guide/en/security/current/rules-ui.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
curl -sS https://attack.mitre.org/resources/navigator/ | head -8
cat > "$PURPLE_LAB/coverage/coverage-matrix-template.md" <<'EOF'
# ATT&CK Coverage Matrix — YOUR lab stub
| Technique | Detection rule | Test method | Last validated | Status |
|---|---|---|---|---|
| T1110.001 | failed-logon-lab.yml | auth.jsonl jq | 2026-08-22 | validated |
| T1082 | [stub or log review] | optional T1082 | pending | gap |
| T1059.001 | not written | — | — | gap |
Status: validated / gap / not-applicable
Update after each purple exercise — feed detection engineering backlog
EOFCommand — copy this
grep -E 'T1110|T1082|validated|gap' "$PURPLE_LAB/coverage/coverage-matrix-template.md"
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK Navigator (https://attack.mitre.org/resources/navigator/); MITRE ATT&CK (https://attack.mitre.org/); Elastic ATT&CK (https://www.elastic.co/guide/en/security/current/rules-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Rule cross-reference
Each technique links Module 4–5 rule ID — not orphan ATT&CK rows.
N/A stub documents why technique not in lab scope — not silent skip.
3. Refused
No fabricated tested status; no prod coverage claims without RoE data.
Matrix literacy supports tuning — not checkbox theater.
4. What you ship: coverage matrix stub
Ten technique rows + rule mapping + honest status + UTC + NEVER fabricated coverage line.
5. What you record before the next lesson
Coverage matrix stub path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark all ATT&CK techniques green tested without running any atomics on lab VM.
Right
Coverage matrix stub from `$PURPLE_LAB` exercises. Next: Gap Analysis.
Mission: coverage matrix stub
1) Name five matrix literacy rows. 2) Ten techniques from Modules 6–7. 3) Rule mapping and honest status each. 4) Write NEVER fabricated coverage line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “N/A row — minimum documentation literacy?”
Knowledge Check
APPLY: Coverage matrix literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Untested techniques may show as tested.
True or False
Knowledge Check
APPLY: Coverage matrix includes:
Multiple choice