Overview

Home About this project and why it exists

Reference

Windows Event Log Reference 99 events across 5 log sources NIST SP 800-53 Mapping 34 controls to event-code evidence MITRE ATT&CK Coverage 30 techniques, tactic gap analysis MITRE ATLAS Coverage AI/ML threat map, 6 techniques + honest gaps CIS Controls Coverage Controls 5 & 8, 6 safeguards + honest gaps PCI DSS Requirement 10 Log & monitor access, 7 sub-reqs + honest gaps DISA STIG Coverage Windows Server 2022 V2R4, 4 rules + honest gaps

Tools

Gravity Scanner Live policy, gap analyzer, dependency map 7 views

Blog

Blog Notes on logging, cost, and detection tradeoffs

MITRE ATT&CK® Enterprise · v19

Enterprise Coverage Map

The Windows event codes that give you detection evidence for each technique, grouped by tactic.

Scope: 30 of ATT&CK's 222 techniques have real native-log detection value here. The gap list at the bottom names what this catalog can't see.