1.4. The Adversary Model and the SOC Loop

💡 First Principle: Defenders need a shared vocabulary for what attackers do, independent of any vendor's alert names. MITRE ATT&CK provides that vocabulary as a matrix of attacker goals and methods. Once behaviors have names, a SOC can measure where its detections cover the adversary and where they don't, and can run a continuous loop of detecting, hunting, responding, and automating to close the gaps.

The stakes are practical. When a CISO asks "are we covered against ransomware operators?", an honest answer requires mapping known attacker behaviors to your rules and data. On the exam, ATT&CK appears directly (analyzing coverage in Sentinel, 2.5.3) and indirectly (alert categories, threat analytics reports, and incident attack stories all use ATT&CK tactics).

Think of ATT&CK as a floor plan of a building with every door and hallway labeled. Mapping your detections onto it is like marking which doors have cameras: the unmarked doors are your blind spots, whatever the camera vendor calls its alerts.

⚠️ Common Misconception: "A rule mapped to a technique means we're protected against it." Mapping is a label, not a measurement. A technique can be mapped yet weakly detected because the rule is narrow, its data source is missing, or the rule is disabled. Another misconception treats hunting and detection as the same activity; they are different stages of one loop, covered in 1.4.2.