SECURIX Developed Free Resource
SIEM Data Check
A free web tool that shows which MITRE ATT&CK techniques your SIEM can see based on the data it collects, with a coverage layer you can export to the ATT&CK Navigator.
Solution overview
The SIEM Data Check is a free web tool for assessing whether your SIEM collects the data needed to detect relevant MITRE ATT&CK techniques. Your team rates available data components as Full, Partial or None, producing a coverage layer for ATT&CK Navigator. Results reflect your self-assessment and help identify data collection priorities.
Your business needs
Your detection priorities depend on the data you collect
Data coverage
Collecting large log volumes does not establish whether the telemetry needed for relevant techniques is available.
Onboarding priorities
Your team needs to identify which additional data components would address meaningful coverage gaps.
Relevant threats
Comparing data coverage with relevant threat groups helps focus investment and detection planning.
Who this is for
SOC and detection teams
Teams preparing SIEM projects, migrations or detection engineering initiatives.
SOC Manager
A shared view of self-assessed telemetry coverage to guide onboarding and detection priorities.
SIEM Engineer
Data component descriptions and logging guidance to identify collection gaps.
Detection Engineer
A baseline for checking whether the data required by planned detections is available.
Our deliverables
A coverage baseline for your next SIEM decisions
Rate your available data and review the resulting technique coverage.
- Rate as full, partial or noneRate each ATT&CK data component against the telemetry your SIEM collects.
- Coverage overview per technique and sub-techniqueReview the coverage derived from your ratings, with a description of each technique.
- ATT&CK Navigator layerDownload the filtered result with green, amber and red coverage ratings.
- Notes on data collectionDescriptions show which data should be logged and how, supporting your ratings and onboarding priorities.
- Filter by platform and tacticNarrow the results down to the platforms and ATT&CK tactics that matter to you.
- Onboarding data sources
- Building detections
- Verifying the answers against a real cluster
- Report or PDF export
- Customer workspaces
- A connection to a real SIEM
Your answers are not stored server-side. Results are retained in the downloaded layer file.
How it works
From data assessment to coverage gaps
-
Begin a self-assessment of your SIEM telemetry.
-
Select Full, Partial or None using the logging descriptions.
-
Inspect technique and sub-technique coverage using platform and tactic filters.
-
Download your results for ATT&CK Navigator.
-
Compare the layer with relevant threat groups, campaigns or software to identify gaps.
Assessment approach
Data coverage mapped to MITRE ATT&CK
ATT&CK data components
Assess the telemetry available for each component described in the tool.
Techniques and sub-techniques
Review the coverage calculated from the associated data ratings.
Threat groups, campaigns or software
Compare your exported layer in ATT&CK Navigator to focus on relevant gaps.
Data coverage indicates whether supporting telemetry may be available. It does not verify that detection rules are enabled, correctly configured or effective.
Related tools
Continue from data coverage to detection
SIEM Rule Builder
Use the Navigator layer as the next step toward exporting Kibana detection rules.
AI SIEM Review
Assess your actual Elastic Security environment through read-only checks and specialist-validated findings.
Technology partners
Built on our Elastic expertise
Frequently asked questions
Before your check begins
No. You rate the data components yourself. The results depend on the accuracy of that assessment.
Not necessarily. The check maps available data to ATT&CK techniques. It does not test detection rules or verify the quality of your actual telemetry.
Export the Navigator layer and compare it with relevant threat groups, campaigns or software. Use the gaps to prioritize data onboarding and detection engineering.
Contact
Let’s discuss your next step
Tell us about your SIEM data priorities. Together, we’ll clarify the gaps and how we can support your next steps.
