Last reviewed:
An ATT&CK heatmap is only useful when the gaps are ranked by likely attacker behaviour, cloud exposure and the cost of fixing the telemetry.
A blank cell in an ATT&CK heatmap is not automatically a crisis. Some techniques may sit outside your cloud architecture. Others may be blocked by controls before they become useful detection work. The heatmap starts the conversation; it should not make the decision for you.
The first pass is scoping. Keep cloud-relevant techniques, then separate direct detection gaps from gaps that depend on endpoint, network or SaaS telemetry you do not collect in the same programme.
Prioritise gaps that sit on realistic attack paths. In cloud estates, that usually means identity abuse, control-plane changes, exposed public services, logging changes and data access. A gap near the start of the path may deserve attention before a noisier technique later in the chain.
Use recent incident reviews, threat reports and your own exposure data. If internet-facing workloads and federated identity are the risky areas, T1190 and T1078.004 should not be buried under a generic tactic average.
Some gaps need a rule. Others need a log source, a parser or a licensing change before a rule can work. That cost should change the order of work. A high-risk gap with no available telemetry may become a logging project; a medium-risk gap with clear audit events can ship this week.
For GCP, Data Access logs are the obvious example. For Azure, the question may be whether Entra ID and Activity Log data reach Sentinel. For AWS, it may be whether CloudTrail management events are complete across accounts and regions.
A useful gap queue names the technique, the missing evidence, the proposed fix and the owner. It should be boring enough to review every month and specific enough that a detection engineer can pick up the next item without decoding a spreadsheet legend.
CloudSigma fits after that prioritisation step. Once the gap is real, scoped and backed by telemetry, a Sigma rule can be written and converted into the SIEM dialect the team actually runs.
technique_id: T1078.004
missing_evidence: Entra service-principal credential additions
fix_type: Sentinel rule over Entra audit logs
owner: detection-engineering
review_date: next monthly coverage review