Lion Cipher Lab
Measure your detection coverage against ATT&CK with DeTT&CT
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
"We have Sysmon" is not a coverage statement — it is a shopping receipt. The question a manager, an auditor, or an incident actually asks is: which adversary behaviours would we SEE, which would we CATCH, and where are the holes? DeTT&CT, the open-source tool from the Rabobank CDC / Dutch defence community, turns that from a gut feeling into a scored, defensible map on the ATT&CK matrix. It scores two different things on purpose: visibility (do I even collect the telemetry that would reveal this technique?) and detection (do I have an analytic that would alert on it?). Visibility is the floor…
What you'll learn
- installing DeTT&CT locally with the published Docker image (or a pip/venv install)
- editing the DeTT&CT data-source YAML to record what telemetry you actually collect
- editing the techniques-administration YAML to score visibility and detection per technique
- telling a VISIBILITY score (can I see it?) from a DETECTION score (would I alert on it?)
- generating ATT&CK Navigator layer JSON with dettect.py and reading it as a coverage heatmap
- overlaying a threat-actor group so the reddest gaps are the ones an actor who targets you can walk through
- knowing when a green heatmap is NOT proof a detection fires, and validating with Atomic Red Team
Steps in this lab
- The idea before the tool: visibility is the floor, detection is the building
- When to reach for DeTT&CT — and when not to
- Install DeTT&CT — the Docker path (easiest)
- Install DeTT&CT — the pip / venv path (if you would rather not use Docker)
- Start from the samples and understand the two YAML file TYPES
- Edit the YAML — by hand, or in the DeTT&CT Editor
- Generate the Navigator layers — the moment it becomes a heatmap
- Open the layer in ATT&CK Navigator and read your coverage
- Overlay a threat actor so the reddest gaps are the ones that matter
- The honest limit: a green heatmap is a claim, not a fired alert