Our security operations team recently concluded a six-month initiative to measurably improve our Mean Time to Detect (MTTD) for specific, high-impact attack techniques. The core of this project was a systematic mapping of our Exabeam Advanced Analytics detections to the MITRE ATT&CK framework. While many vendors claim ATT&CK alignment, we found that a deliberate, granular mapping exercise—followed by targeted rule tuning and dashboard creation—yielded a 38% reduction in MTTD for techniques in our prioritized threat groups.
The initial state was common: we had numerous detections, but they were siloed and described in vendor-specific terms (e.g., "Anomalous New Service Creation"). Our goal was to contextualize them within the adversary lifecycle. We began by exporting all our Exabeam rules and parsing their logic. The mapping process was manual and methodical. For each rule, we asked:
* Which ATT&CK Tactics does this detection potentially cover? (e.g., Persistence, Privilege Escalation)
* Which specific ATT&CK Techniques and Sub-techniques are the most precise fit?
* What is the confidence level (High, Medium, Low) of this mapping based on the rule's logic and our environment?
We structured this in a table format, which I'll illustrate with a simplified example:
| Exabeam Rule Name | Primary Logic | Mapped ATT&CK Tactic | Mapped ATT&CK Technique (ID) | Mapping Confidence |
| :--- | :--- | :--- | :--- | :--- |
| `win_susp_svchost_child` | Alert on `svchost.exe` spawning unexpected child processes (e.g., `cmd.exe`, `powershell.exe`). | Defense Evasion, Privilege Escalation | **T1036.003: Masquerading - Rename System Utilities** | High |
| `unusual_web_dav_connection` | Detect `rundll32.exe` or `regsvr32.exe` making network connections to unusual IPs on ports associated with WebDAV. | Command and Control | **T1105: Ingress Tool Transfer** | Medium |
This exercise revealed immediate coverage gaps. For instance, we had strong coverage for "Lateral Movement" but weak coverage for "Reconnaissance" and "Resource Development." More importantly, it allowed us to measure efficacy per technique. We used Exabeam's Search functionality to calculate historical MTTD per mapped technique over a 90-day baseline period.
The actionable phase involved creating dedicated Exabeam dashboards (via Workbench) for each high-priority ATT&CK Tactic. Each dashboard widget was tied to the mapped rules. For example, the "Persistence" dashboard displayed:
* Time-series of alerts for all Persistence-related techniques.
* Top users flagged by these rules.
* Associated assets.
* Mean and median time from event to alert for the underlying rules.
This visual, technique-centric grouping enabled our Tier 1 analysts to triage with far greater context. Furthermore, we tuned our rules based on this mapping. If a rule mapped to **T1059.001: Command and Scripting Interpreter: PowerShell** was generating noise from legitimate admin scripts, we refined the rule's risk scoring and added exceptions, directly improving the signal-to-noise ratio for that specific technique.
The quantified outcome was a 38% reduction in MTTD across the mapped techniques we prioritized. The qualitative benefits were equally significant: our SOC now speaks a common language (MITRE ATT&CK), our detection engineering is now gap-driven, and our reporting to leadership is framed in terms of adversary behavior coverage rather than just "alert volume."
— Amanda
Data > opinions