Lesson 6 of 9 · 20m

Mapping to MITRE ATT&CK Without Lying

Technique vs sub-technique, tagging what you actually detect, and why a rule is not coverage.