Purple › Module 8 › Lesson 2
Gap Analysis
Gap analysis literacy — untested techniques, missing rules, telemetry blind spots, priority ranking — gap rows on YOUR `$PURPLE_LAB` matrix.
Visual · t35_gap_analysis
Gap analysis = named coverage gaps. $PURPLE_LAB. Original Cyberlium.
Opening
Coverage matrices reveal gaps — name untested techniques and telemetry blind spots on YOUR lab before pushing unauthorized prod rule changes.
Gap analysis literacy names: untested technique gap category, missing detection rule category, telemetry source blind spot category, false negative hypothesis category, and priority ranking category (P1/P2/P3 literacy stub). Analyst documents gap register on `$PURPLE_LAB` coverage matrix from 8-1 — three gaps with root cause stub and proposed action literacy — without deploying unauthorized prod SIEM rules, without claiming gaps closed without validation, without stranger org gap assumptions. Cyberlium links matrix to improvement — YOUR notes. Refused: unauthorized prod rule deploy, gap closure without test, attack repro on stranger networks. Lab row: gap register (three gaps, root cause, priority, proposed action stub).
1. Named gap rows
Untested technique, missing rule, telemetry blind spot, false negative hypothesis, priority — five literacy anchors.
Each gap links matrix row from 8-1 — same exercise thread.
Command guide
Try these commands — Named gap rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Splunk security content — https://github.com/splunk/security_content Sigma — https://sigmahq.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/coverage/gap-analysis.md" <<'EOF'
# Coverage Gap Analysis — YOUR lab
## Validated
- T1110.001: failed-logon-lab.yml + auth.jsonl jq test PASS (UT-01)
## Gaps (priority order)
1. T1082: no automated rule — log review only → write stub or enable audit
2. T1059.001: no process jsonl seeded → extend telemetry if brief assigns
3. T1078: valid account abuse after guess — correlate 4624 with prior 4625
## Remediation owners (fictional)
- Detection engineering: new Sigma stubs
- Logging team: enable 4688 on lab VM
- Purple lead: schedule next safe exercise
NEVER: run banned atomics to 'fill' gaps on stranger networks
EOFCommand — copy this
grep -E 'Validated|Gaps|NEVER|T1110' "$PURPLE_LAB/coverage/gap-analysis.md"
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Splunk security content (https://github.com/splunk/security_content); Sigma (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Priority discipline
P1 = high-impact technique with no rule — document rationale on lab stub.
Proposed action cites lab or ticket path — not unauthorized prod deploy.
3. Refused
No unauthorized prod SIEM changes; no gap closure without validation test.
Gap literacy supports tuning roadmap — not panic rule pushes.
4. What you ship: gap register
Three gaps + root cause + priority + proposed action + NEVER unauthorized prod deploy line.
5. What you record before the next lesson
Gap register path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Push unvalidated detection rules to employer prod SIEM from lab gap register without ticket.
Right
Gap register from `$PURPLE_LAB` coverage matrix. Next: Tuning Loop.
Mission: gap register
1) Name five gap analysis rows. 2) Three gaps from coverage matrix. 3) Priority and proposed action each. 4) Write NEVER unauthorized prod deploy line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “P1 vs P2 — literacy tie-break for untested techniques?”
Knowledge Check
APPLY: Gap analysis literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Gaps may close without validation test.
True or False
Knowledge Check
APPLY: Gap register includes:
Multiple choice