Purpose

The Techniques dashboard provides a high-signal view of how your model performs at the MITRE ATT&CK technique layer. It helps you answer three core questions quickly: How many techniques are in scope? How many are currently covered and validated? Where are the gaps across the ATT&CK tactics? The report is generated from the workbook data and updates as your mappings evolve.

What Adaptive Report reads from the Techniques sheet

Adaptive Report detects that the active context is Techniques and extracts signals directly from the Techniques table. The exact metrics shown reflect the current workbook state (including filters, enabled rows, and configured mapping tables). Typical inputs include technique IDs, technique-to-coverage values, technique-to-test mappings, and any related components used by Merlino to compute dataset-wide statistics.

Dashboard summary cards

The top section of the dashboard presents a concise snapshot of the Techniques dataset, including totals and subset counts. These cards are designed for rapid understanding and are calculated from the current in-scope technique list.

• Total Techniques: the number of techniques currently in scope in the Techniques table.
• With Technique Coverage: the number (and percentage) of techniques that have a calculated technique coverage value.
• With Data Sources: the number (and percentage) of techniques for which required telemetry/data sources are mapped and available.
• With Tests: the number (and percentage) of techniques linked to one or more validation tests in the Merlino test catalogue.

Average coverage indicators

Adaptive Report also computes the average coverage values for the Techniques dataset. These indicators provide a single, measurable signal for each dimension of readiness, while still allowing you to drill down into the table for specifics.

• Avg Technique Coverage: the average technique coverage across all in-scope techniques.
• Avg Data Sources: the average data source coverage across all in-scope techniques (telemetry readiness).
• Avg Tests: the average test coverage across all in-scope techniques (validation readiness).

Coverage by tactic (average)

The Techniques dashboard includes a tactic-level breakdown that shows how coverage behaves across the MITRE ATT&CK chain. This is essential for identifying posture imbalance, for example: strong coverage for discovery and execution, but weaker coverage for exfiltration or command and control. The visualization is built from technique-to-tactic mapping and technique-level metrics, then aggregated by tactic.

What the tactic chart helps you detect

• Imbalance: tactics that consistently lag behind others.
• Overconfidence: tactics that appear “covered” but have low test coverage or weak telemetry readiness.
• Prioritization targets: where improving a small set of techniques can shift the tactic average significantly.
• Validation focus: tactics where test coverage is trailing behind technique mapping.

Refresh and export

The Techniques dashboard is designed for iterative work. As you add mappings, adjust priorities, or update technique associations, you can regenerate the dashboard instantly to reflect the new posture.

• Refresh: recalculates totals, averages, and tactic breakdowns using the latest Techniques table state.
• Export as PNG: generates a clean image that can be dropped into documents, slide decks, tickets, or customer reports without manual formatting.

Typical outcomes

• Fast posture snapshot: a quick, measurable summary of technique readiness.
• Gap identification: clarity on which tactics and technique clusters require attention.
• Validation steering: align test creation and execution to the most important technique gaps.
• Defensible reporting: export evidence-backed visuals for stakeholders.

Note: The Techniques Adaptive Report is driven entirely by your workbook data and mappings. The richer and more consistent your links between techniques, tests, and telemetry/data sources, the more accurate and actionable the dashboard becomes.