Most detection gaps aren’t tooling problems. You don’t buy a better SIEM to fix blind spots. You plan first, instrument second.

The workflow that closes gaps:

  1. Pick the adversary and kill chain. “Lateral movement by admin” or “credential dump to cloud API.” Not “everything.” Narrow kill chains are detectable. Broad ones are noise.
  2. Map to ATT&CK. Which tactics/techniques cover that kill chain? T1021 (Remote Services), T1550 (Use Alternate Auth Material). Two techniques, not forty.
  3. Identify the telemetry. What log source fires for each technique? Windows Security EventID 4624 LogonType 10, EDR process tree, proxy HTTP 401→200 on auth endpoints.
  4. Write the rule against the telemetry, not the idea. “If LogonType 10 from new CIDR + privileged account → alert.” Testable. Falsifiable.
  5. Instrument only what the rule needs. Don’t ship a log-parsing pipeline for a technique you haven’t picked.

The opposite workflow — “ship all logs, tune later” — produces alert fatigue, not coverage. You detect the last thing you looked at and miss the first thing the attacker does.

Start from behavior. Instrument what you planned to see.

Further reading: MITRE ATT&CK navigation, your own runbook for the top 5 techniques on your assets.