Dataset Overview
Definition：ATT&CK Detection Gap and TTP Reasoning Datasetis provided byChangsha Langhui Information Technology Co., Ltd.The focus is on the current enterprise safety detection system with a blind coverage area, providing detailed detection gap analysis, multistep TTP reasoning chains and log data source mapping for each ATT&CK technology, and training in the capability to assist in engineering automation and safety large model reasoning.
| Dataset Name | ATT&CK Detection Gap and TTP Reasoning Dataset |
| Total Data Volume | 500~1,500 |
| Data Type | Structured JSON |
| Data Source | Langhui Security Laboratory |
| License Type | Commercial Licensing Complete authorization documents are attached |
| Delivery Cycle | 3-4 |
| Overwrite Technology | 100+AT&CK Technology/Subtechnologies |
| Output Format | JSONL / CSV |
| Language | Chinese-English Bilingual |
Core Data Fields
Each data contains technical identification, detection gap analysis, TTP reasoning chain, log data source mapping and recommended detection rules, covering the full chain from gap identification to rule generation.
| Field Category | Field Count | Typical Fields |
|---|---|---|
| Technical identification | 4 | Technique_id (ATT&CK technical ID), technique_name (technical name), technical (accomplicated tactics), platform (applicable platform) |
| Test Gap Description | 3 | Dete action_gap (detailed description of the detection gap), gap_category (disparities category: blind areas/misreporting/delayed), impact_assessment (impact assessment) |
| TTP chain of reasoning | 4 | Step_no (serial number of attack step), action (description of attack action), tool_used (use of tools/technology), expected_log (expected log feature) |
| Log Data Source Map | 3 | Data_source (data source type), log_ type (logbook type, e.g. Windows Evet/NetFlow/EDR), log_field (key log field) |
| Recommended testing rules | 3 | rule_type (rule type: Sigma/YARA/Snort), rule_content (rules content clip), false_positive_rate (expected misreporting rate) |
Data Sample Showcase
The following is a structured JSON sample showing typical data formats for testing gap analysis, TTP reasoning chains and recommended rules.
Other Organiser
"entry id": "GAP-2024-0000347",
"technique id": "T1562.001",
"technique name": "Disabled or modified system firewalls",
"Tactic": "Defense Evasion",
"platform": "Windows",
"detion gap": {
"description": "The attackers are using the netsh or PowerShell to disable the Windows firewall, and most SIEM programmes currently monitor only service stoppages (Event ID 7036), but not those that do not produce service stoppages, but are recorded in the Microsoft-Windows-Windows Firewall Wyth Advanced Security/Firwall operational logs. " ,
"gap category": "Detect the blind zone,"
"impact assessment": "high -- leading to subsequent C2 communications not subject to firewalls, often during the initial phase of extortion software attacks."
{\cHFFFFFF}{\cH00FFFF}
"ttp chain":
"Step no": 1, "action": "Get Initial Access Through Fishing Mail", "tool used": "Spear-rating Attachment", "expected log": "Email Gateway: malicious attachment delivery record" ,
"Step no": 2, "action": "exercise PowerShell downloads C2 tools", "tool used": "PowerShell Invoke-WebRequest", "expected log": "Sysmon Event ID 1: Powershell.exe → TCP 443 outside" ,
"Step no": 3, "action": "Disable Windows Defense Real-Time Protection", "Tool used": "Set-MpPreference-Dealable Realtime Monitoring Dollar", "expected log": "Windows Defense Operations: Event ID 5001",
"Step no": 4, "action": "Deactivate Windows firewall": "netsh advfirewall set allprofils state off", "expected log": "Windows Firewall Office: Event ID 2003"
== sync, corrected by elderman == @elder man
I don't know.
"log source mapping": {
"Data source": "Windows Firewall National Log,"
"Log type": "Soft-Windows-Windowall with Advanced Security/Firawall,"
"log field": "Event ID 2003 (Setting changed), 2004 (Rule added), 2005 (Rule reduced)"
{\cHFFFFFF}{\cH00FFFF}
"suggested rule":
"rule type": "Sigma",
"rutle content": "title: Windows Firewall Disabled Via Netsh\n logsource: prevention: window, service: security:
"false positive rate": "low."<5%）— sample"
},
"answer": {
"is_attack": true,
"attack_type": "sample value",
"attck_phase": "Defense Evasion",
"detection_feasibility": "sample — CNFirewall OperationalCN"
}
}AI Application Scenarios
Testing engineering automation
Based on 1,500 detection gap analysis data, AI was trained to identify automatically the blind areas covered by the current SOC testing, and to generate the Sigma/YARA/Snort testing rules automatically, significantly improving the efficiency and coverage of the detection project.
SIEM rules smart generation
Using TTP ' s reasoning chain and log data source mapping data, AI was trained to automate the description of the attack into SIEM query rules and linkage analysis strategies, and to automate the end-to-end from ATT&CK to the end of the detectable.
Training in the reasoning chain
The multistep TTP chain of reasoning trained the causal ability of the large security model to trace back from a single warning to a complete attack chain, understand the logic of the aggressor ' s behaviour and predict the next attack.
Red and blue against simulations
Building on real detection gaps and TTP chain data, AI Red Corps agents automatically generate attack paths that bypass existing tests for continuous assessment and enhancement of enterprise security defences.
Safety base model assessment
The detection gap data sets can serve as a standardized assessment benchmark for large safety models, and quantitative assessment models for detection coverage and reasoning accuracy of various attack techniques, resulting in comparable capability images.
ATT&CK coverage assessment
Automatically analyse the detectability of existing corporate log sources to ATT&CK technologies, output cover heat effort and gap list, and provide data-driven prioritization for security building inputs.
Frequently asked questions
Needed customised testing of engineering data programs?
Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform, which aims to provide high-quality, compliant security data assets to AI enterprises and scientific institutions. Supports flexible combinations by technical category, by data source, by type of test rule.
Data sample previews Customized testing rule options Professional technical support