Method
ATT&CK v19 Hunt Coverage Mapper
Is the hunt hypothesis evidence-anchored and versioned?
Field scoring contract
| Field | Type | Role | Direction | Scored |
|---|---|---|---|---|
| Hunt hypothesis | text | context | context | no |
| ATT&CK tactic/technique | text | context | context | no |
| Telemetry coverage | select | evidence_signal | higher_is_better | yes |
| Benign baseline evidence | select | evidence_signal | higher_is_better | yes |
| Detection logic mapped to data components | select | evidence_signal | higher_is_better | yes |
| Falsification / negative test | select | evidence_signal | higher_is_better | yes |
| Human analyst review evidence | select | evidence_signal | higher_is_better | yes |
Limits
- Preliminary output
- Human review required
- Not certification
- Context text is not averaged into numeric scores.
- Outputs require source/evidence review before decisions.