Compliance audit answer · threatengine.sh

Home/Compliance/Audit answer

Audit

Compliance audit answer

For a whole framework: every control, the ATT&CK techniques it defends, and whether you can detect them

This is the one-page answer to "are my controls actually backed by detection?". For each control in the framework it shows the ATT&CK techniques the control maps to, and marks each technique detectable when a real rule (Sigma, CAR, IDS, YARA, Falco) covers it, or a gap when nothing does. Honest by construction: control-to-technique links come only from the published mappings, and a technique counts as detectable only if a real rule maps to it. Controls with no ATT&CK mapping are shown as such, not hidden. Export the full matrix for your auditor below.

NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)

60

CRI Profile controls

60

controls with ATT&CK mapping

430

distinct techniques defended

290

of those, detectable

67%

overall detection coverage

Export matrix (CSV) Export (JSON) the artifact to hand an auditor

▤

Coverage by control family

11 families

Family	Controls	Mapped	Techniques	Detectable	Coverage
DE.AE	1	1	81	57	70%
DE.CM	10	10	202	142	70%
EX.DD	1	1	10	8	80%
EX.MM	1	1	11	6	54%
ID.AM	2	2	25	17	68%
ID.IM	1	1	15	9	60%
ID.RA	1	1	11	11	100%
PR.AA	10	10	226	165	73%
PR.DS	6	6	39	28	71%
PR.IR	10	10	219	154	70%
PR.PS	17	17	309	212	68%

▤

Control-by-control coverage

60 controls

DE.CM-01.01 Intrusion detection and prevention 30/41 detectable

DE.CM-01.02 Network traffic volume monitoring 4/8 detectable

T1498.001 T1498.002 T1499.002 T1499.003 T1498 T1499 T1499.001 T1499.004

DE.CM-01.03 Unauthorized network connections and data transfers 11/14 detectable

T1048.002 T1104 T1599 T1008 T1030 T1041 T1048 T1048.001 T1048.003 T1090 T1095 T1102 T1571 T1572

DE.CM-01.04 Unauthorized device connection 1/3 detectable

T1052 T1052.001 T1200

DE.CM-01.05 Website and service blocking 20/22 detectable

T1566.003 T1659 T1059 T1059.005 T1059.007 T1102 T1102.001 T1102.002 T1102.003 T1189 T1204 T1204.001 T1204.002 T1218 T1218.001 T1528 T1539 T1550 T1555.003 T1566 T1566.001 T1566.002

DE.CM-03.03 Privileged account monitoring 29/41 detectable

DE.CM-09.01 Software and data integrity checking 31/46 detectable

DE.CM-09.02 Hardware integrity checking 4/8 detectable

T1195.003 T1542 T1542.002 T1600.002 T1091 T1495 T1542.001 T1562.001

DE.CM-09.03 Unauthorized software, hardware, or configuration changes 5/7 detectable

T1542.002 T1601 T1495 T1542.001 T1543 T1556 T1562

EX.DD-04.01 Third-party systems and software evaluation 8/10 detectable

T1036.001 T1542.002 T1036 T1072 T1190 T1195 T1195.001 T1195.002 T1210 T1554

EX.MM-01.01 Third-party monitoring and management resources 6/11 detectable

T1195.003 T1530 T1601 T1601.001 T1601.002 T1195 T1195.001 T1195.002 T1199 T1525 T1554

ID.AM-08.03 Data governance and lifecycle management 17/25 detectable

ID.AM-08.05 Data destruction procedures 17/25 detectable

ID.IM-02.06 Accurate data recovery 9/15 detectable

T1485.001 T1491 T1491.002 T1498.001 T1498.002 T1561 T1485 T1486 T1490 T1491.001 T1498 T1561.001 T1561.002 T1565 T1565.001

ID.RA-01.03 Vulnerability management 11/11 detectable

T1072 T1190 T1195 T1195.001 T1195.002 T1203 T1210 T1211 T1212 T1495 T1574

PR.AA-01.01 Identity and credential management 126/175 detectable

T1003.007 T1003.008 T1020.001 T1021.008 T1036.010 T1053.006 T1053.007 T1059.008 T1098.002 T1098.006 T1110.003 T1110.004 T1114.002 T1213.001 T1213.002 T1213.004 T1485.001 T1530 T1538 T1543.005 T1547.012 T1547.013 T1548.005 T1556.001 T1556.003 T1556.005 T1556.007 T1556.009 T1558.001 T1558.002 T1558.004 T1562.004 T1562.007 T1562.008 T1562.012 T1563 T1563.001 T1566.003 T1578.001 T1578.002 T1578.005 T1599 T1601 T1601.001 T1601.002 T1648 T1654 T1657 T1666 T1003 T1003.001 T1003.002 T1003.003 T1003.004 T1003.005 T1003.006 T1006 T1021 T1021.001 T1021.002 T1021.004 T1021.007 T1036 T1040 T1047 T1048 T1053 T1053.002 T1053.003 T1053.005 T1059 T1072 T1078 T1078.001 T1078.002 T1078.003 T1078.004 T1087 T1087.004 T1098 T1098.001 T1098.003 T1098.004 T1098.005 T1110 T1110.001 T1110.002 T1114 T1133 T1134 T1134.001 T1134.002 T1134.003 T1134.005 T1136 T1136.001 T1136.002 T1136.003 T1185 T1187 T1195 T1197 T1199 T1201 T1213 T1213.003 T1484 T1484.001 T1484.002 T1485 T1489 T1490 T1505 T1505.003 T1528 T1537 T1539 T1543 T1543.002 T1543.003 T1543.004 T1546 T1546.003 T1546.011 T1547 T1547.004 T1547.006 T1547.009 T1548 T1548.002 T1550 T1550.001 T1550.002 T1550.003 T1552 T1552.001 T1552.002 T1552.004 T1552.006 T1552.007 T1555 T1555.001 T1555.003 T1555.005 T1556 T1556.004 T1556.006 T1558 T1558.003 T1562 T1562.001 T1562.002 T1562.006 T1563.002 T1566 T1566.001 T1566.002 T1569 T1569.001 T1574 T1574.005 T1574.010 T1574.012 T1578 T1578.003 T1580 T1599.001 T1606 T1606.002 T1609 T1610 T1613 T1619 T1621 T1649

PR.AA-01.02 Physical and logical access 40/52 detectable

PR.AA-02.01 Authentication of identity 20/24 detectable

PR.AA-03.01 Authentication requirements 40/52 detectable

PR.AA-03.03 Email verification mechanisms 6/10 detectable

T1114.002 T1598 T1598.002 T1598.003 T1114 T1114.001 T1114.003 T1566 T1566.001 T1566.002

PR.AA-04.01 Access control within and across security perimeters 5/5 detectable

T1087.004 T1098 T1213 T1548 T1565

PR.AA-05.01 Access privilege limitation 28/31 detectable

PR.AA-05.02 Privileged system access 98/130 detectable

T1003.007 T1003.008 T1053.006 T1053.007 T1056.003 T1059.008 T1098.002 T1098.006 T1110.003 T1110.004 T1114.002 T1530 T1542 T1542.005 T1548.006 T1553.006 T1555.006 T1556.001 T1556.003 T1556.005 T1556.007 T1558.001 T1558.002 T1562.009 T1563 T1563.001 T1599 T1601 T1601.001 T1601.002 T1612 T1651 T1003.006 T1021 T1021.001 T1021.002 T1021.003 T1021.004 T1021.006 T1021.007 T1040 T1047 T1053 T1053.002 T1053.005 T1055 T1055.008 T1056 T1059 T1059.001 T1059.009 T1072 T1078 T1078.001 T1078.002 T1078.003 T1078.004 T1098 T1098.001 T1098.003 T1098.005 T1110 T1110.001 T1110.002 T1114 T1133 T1134 T1134.001 T1134.002 T1134.003 T1136 T1136.001 T1136.002 T1136.003 T1190 T1199 T1210 T1213 T1213.003 T1218 T1218.007 T1222 T1222.001 T1222.002 T1484 T1484.002 T1485 T1495 T1505 T1505.001 T1505.002 T1505.004 T1525 T1539 T1542.001 T1542.003 T1543 T1543.002 T1546 T1546.003 T1547 T1547.006 T1548 T1548.002 T1548.003 T1550 T1550.002 T1550.003 T1552 T1552.002 T1552.007 T1553 T1555 T1556 T1556.004 T1556.006 T1558 T1558.003 T1559 T1559.001 T1562 T1563.002 T1569 T1569.002 T1599.001 T1606 T1606.002 T1609 T1611 T1621

PR.AA-05.03 Service accounts 18/22 detectable

T1558.001 T1558.002 T1563 T1563.001 T1021 T1021.002 T1021.003 T1021.006 T1021.007 T1078 T1078.002 T1098 T1190 T1210 T1484 T1484.002 T1548 T1558 T1558.003 T1559 T1559.001 T1563.002

PR.AA-05.04 Third-party access management 5/7 detectable

T1110.003 T1110.004 T1078 T1078.004 T1110 T1110.001 T1199

PR.DS-01.01 Data-at-rest protection 11/12 detectable

T1530 T1003.003 T1005 T1040 T1041 T1048.003 T1213 T1550.001 T1557 T1557.002 T1565.001 T1565.002

PR.DS-01.02 Data loss prevention 5/11 detectable

T1020.001 T1025 T1048.002 T1052 T1052.001 T1567.004 T1005 T1041 T1048 T1048.003 T1537

PR.DS-01.03 Removable media protection 2/4 detectable

T1025 T1092 T1030 T1200

PR.DS-02.01 Data-in-transit protection 6/6 detectable

T1040 T1550 T1550.001 T1550.002 T1550.003 T1565.002

PR.DS-10.01 Data-in-use protection 12/17 detectable

T1025 T1052 T1052.001 T1530 T1602 T1005 T1020 T1040 T1041 T1048 T1070 T1119 T1213 T1537 T1565 T1565.001 T1567

PR.DS-11.01 Data backup and replication 7/9 detectable

T1485.001 T1561 T1485 T1486 T1490 T1561.001 T1561.002 T1565 T1565.001

PR.IR-01.01 Network segmentation 33/40 detectable

PR.IR-01.02 Network device configurations 29/39 detectable

PR.IR-01.03 Network communications integrity and availability 67/95 detectable

PR.IR-01.04 Wireless network protection 17/20 detectable

T1048.002 T1573.001 T1573.002 T1021 T1021.001 T1021.002 T1021.003 T1021.006 T1040 T1046 T1048 T1048.001 T1048.003 T1095 T1098 T1200 T1570 T1571 T1572 T1573

PR.IR-01.08 End-user device access 13/19 detectable

T1027.012 T1027.013 T1027.014 T1036.008 T1080 T1564.012 T1006 T1027 T1027.002 T1027.009 T1027.010 T1036 T1059 T1059.001 T1059.005 T1059.006 T1221 T1547.006 T1564

PR.IR-03.01 Alternative resilience mechanisms 13/23 detectable

T1020.001 T1025 T1048.002 T1052 T1052.001 T1485.001 T1491 T1491.002 T1561 T1567.004 T1005 T1020 T1041 T1048 T1048.003 T1485 T1486 T1490 T1491.001 T1537 T1561.001 T1561.002 T1567

PR.IR-04.01 Utilization monitoring 30/36 detectable

PR.IR-04.02 Availability and capacity management 7/12 detectable

T1498.001 T1498.002 T1499.002 T1499.003 T1561 T1485 T1486 T1498 T1499 T1499.004 T1561.001 T1561.002

PR.PS-01.03 Configuration deviation 70/101 detectable

PR.PS-01.04 Time services and synchronization 2/4 detectable

T1497.003 T1498.002 T1070.006 T1547.003

PR.PS-01.05 Encryption standards 17/28 detectable

PR.PS-01.06 Encryption management practices 17/28 detectable

PR.PS-01.09 Virtualized end point protection 23/32 detectable

PR.PS-02.01 Patch identification and application 26/34 detectable

PR.PS-05.01 Malware prevention 13/18 detectable

T1027.013 T1027.014 T1036.008 T1080 T1566.003 T1027 T1027.002 T1027.009 T1027.010 T1036 T1059 T1059.001 T1059.005 T1059.006 T1221 T1547.006 T1566 T1566.001

PR.PS-05.03 Email and message service protection 5/10 detectable

T1071.003 T1566.003 T1566.004 T1598 T1598.003 T1204.001 T1204.002 T1566 T1566.001 T1566.002

PR.PS-06.01 Secure SDLC process 15/21 detectable

T1496.003 T1559.003 T1564.009 T1564.012 T1574.002 T1647 T1078 T1078.001 T1078.002 T1078.003 T1078.004 T1195 T1195.001 T1212 T1550 T1550.001 T1559 T1564 T1574 T1593 T1593.003

PR.PS-06.05 Testing and validation strategy 9/10 detectable

T1036.001 T1068 T1127 T1190 T1203 T1210 T1211 T1212 T1505 T1554

PR.PS-06.06 Vulnerability remediation 13/18 detectable

T1137.004 T1137.005 T1176 T1542 T1542.002 T1068 T1137 T1137.003 T1190 T1195 T1195.001 T1195.002 T1203 T1210 T1211 T1212 T1495 T1542.001

PR.PS-06.07 Development and operational process alignment 13/18 detectable

T1496.003 T1559.003 T1564.009 T1564.012 T1647 T1078 T1195 T1195.001 T1212 T1496 T1550 T1550.001 T1559 T1564 T1574 T1574.001 T1593 T1593.003

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin