Developing and prioritizing a detection engineering backlog based on MITRE ATT&CK

This report provides a practical framework for SOCs to prioritize detection logic by mapping available data sources to MITRE ATT&CK techniques, scoring source quality and visibility with DeTT&CT, and combining these with technique prevalence to rank detection opportunities. It details steps to inventory and assess data sources, visualize coverage in ATT&CK Navigator, calculate weighted visibility scores, and merge with attacker usage to produce a prioritized detection backlog, while highlighting limitations of historical frequency data and offering extensions for maturity, such as grouping by detection domain, attack stage, and improving source coverage and quality.