SOC › Module 9 › Lesson 2
Detection Gaps
Detection gap literacy — missing telemetry, rule tuning, hunt hypothesis updates — from $HUNT_LAB PIR findings.
Visual · t30_detection_gaps
Detection gaps = named visibility rows. $HUNT_LAB. Original Cyberlium.
Opening
Every incident exposes visibility holes — name detection gaps from YOUR PIR before the same blind spot fires again.
Detection gap literacy names: missing log source category, delayed ingestion category, rule threshold too high category, MITRE technique uncovered category, hunt hypothesis not tested category, and purple-team coordination stub category. Analyst maps $HUNT_LAB PIR action items to gap rows — proposes defender fixes (enable logging category, new correlation rule category, hunt query update) — without deploying offensive tools to 'prove' gaps, without unauthorized prod rule changes, without SIEM suppression to hide misses. Cyberlium links Module 2–5 hunt work — improvement vocabulary. Refused: attack generation to justify gaps, prod detection disable, hiding gaps from PIR. Lab row: detection gap table (gap, impact, fix category, owner stub) with three rows from lab PIR.
1. Named gap types
Missing source, ingestion delay, rule tuning, uncovered technique, untested hypothesis — five literacy anchors.
Gap row ties to measurable fix — not vague 'monitor more.'
Command guide
Try these commands — Named gap types
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Detection gaps — https://attack.mitre.org/ Sigma tuning — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide Elastic gaps — https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/pir/detection-gaps-LAB-IR-001.md" <<'EOF'
# Detection Gaps — LAB-IR-001
## Gap 1: Failed-then-success window
- Current: single 4625 alert threshold
- Needed: sequence detection (3 fail → 1 success within 5min)
- MITRE: T1110.001
## Gap 2: Rare parent process
- Current: no winword→powershell rule in lab
- Needed: sigma stub + threshold for office apps
- MITRE: T1059.001
## Gap 3: Beacon interval
- Current: netflow not correlated to auth events automatically
- Needed: cross-source correlation rule
- MITRE: T1071.001
## Remediation (lab)
- See hunt/tuning-notes-l2.txt for proposed changes
EOFCommand — copy this
grep -E 'Gap|T1110|T1059|T1071' "$HUNT_LAB/pir/detection-gaps-LAB-IR-001.md" grep threshold "$HUNT_LAB/hunt/tuning-notes-l2.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Detection gaps (https://attack.mitre.org/); Sigma tuning (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic gaps (https://www.elastic.co/guide/en/security/current/detection-engine-overview.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender fixes
Enable log, tune threshold, add hunt query, dashboard visibility — literacy categories.
Coordinate with engineering stub — L2 recommends, does not solo prod change without RoE.
3. Refused
No attack generation to prove gaps; no prod rule suppression.
Gap literacy supports detection improvement — not blame avoidance via hiding.
4. What you ship: detection gap table
Three gap rows + fix category + owner stub + NEVER attack-for-gap line.
5. What you record before the next lesson
Detection gap table path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run unauthorized attacks to 'demonstrate detection gap' for PIR credit.
Right
Detection gap table from $HUNT_LAB PIR. Next: L3 Handoff.
Mission: detection gap table
1) Name five gap types. 2) Three gap rows from lab PIR. 3) Fix category per row. 4) Write NEVER attack-for-gap line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Uncovered MITRE technique — hunt link?”
Knowledge Check
APPLY: Detection gap literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Attack generation to prove gaps is lab.
True or False
Knowledge Check
APPLY: Gap fix should:
Multiple choice