Project · Cyber Security: from zero to SOC analyst
Project: detection coverage with MITRE ATT&CK
The brief
A UPI payments start-up in Bengaluru asks: "Can we actually detect the attacks that matter to us?" You map its SIEM rules and alerts to MITRE ATT&CK, measure coverage, list the gaps by tactic, score the top risks, work out the CERT-In reporting deadline, and write a one-page memo for the CISO.
Why it matters
Senior SOC analysts, detection engineers and security leads report coverage to management and decide which detections to build next. ATT&CK is the shared language for that, risk scores decide what gets money first, and Indian companies must report many incidents to CERT-In within 6 hours. This is the work that moves you beyond L1.
Skills you practise
- MITRE ATT&CK tactics and techniques
- detection coverage and gaps
- risk scoring (likelihood x impact)
- CERT-In reporting timelines
- writing for management
What you will have at the end
coverage.py, a tested coverage and risk calculator, and memo.txt, a one-page detection-gap memo for a CISO.
How it is marked (rubric, 100 points)
| Correct analysisAll checks pass: coverage, gaps by tactic, alerts by tactic, risk bands with validation, and the 6-hour deadline across midnight. | 40 |
|---|---|
| ATT&CK understandingTechniques are mapped to the right tactics and the gaps are explained as attacker behaviour. | 20 |
| Memo qualityOne page, a clear decision, concrete next detections with data sources, and the CERT-In rule. | 30 |
| Code qualitySmall functions, sets for "covered", clear names. | 10 |
0/6 steps done
Step 1 of 6
Measure coverage
coverage(rules, priority) returns the percentage of priority techniques that have at least one rule, rounded to 1 decimal place.
Coverage answers "of the techniques we care about, how many could we detect?" Two rules for the same technique still cover only one technique, so collect the techniques into a set first. Then count how many priority techniques are in it. Here 6 of 9 are covered: 66.7%. Guard against an empty priority list, which would divide by zero.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.