Compliance, Outcomes Navigator, and Security Program Measurement
What this domain tests
How you evidence coverage and control effectiveness: using Outcomes Navigator to find gaps, mapping detections to frameworks, proving retention and access controls, and reporting program metrics that mean something.
Outcomes Navigator
It holds a catalog of security outcomes and use cases, each tied to the log sources and content (rules, models) that satisfy it. The console grades your environment as met, partially met or not met, and separates two very different failure modes: a data gap (required source never ingested, unparsed, or missing key fields) and a configuration gap (data present, but the rule or model is not enabled or tuned). Use it as an onboarding roadmap, not a one-time score.
Framework mapping
Detection content maps to MITRE ATT&CK techniques, which is how you answer "which techniques can we see?". Compliance frameworks - PCI DSS, HIPAA, NIST, ISO 27001, GDPR, SOX - map to control objectives such as log retention, monitoring of privileged access, and audit trail integrity. Coverage claims must be tied to ingested, parsed data.
Measuring the program
- Detection coverage per ATT&CK technique and per framework control.
- Log source health and normalized-field completeness, because unmet outcomes usually start here.
- Alert-to-case ratio, false positive rate, automation rate, MTTD and MTTR.
- Use case adoption: outcomes marked met but never alerted on are theoretical.
Audit evidence
Confirm retention windows meet the regulation before the auditor asks, confirm admin actions are logged and retained, and run access reviews on who can read or delete logs. Export reports with timestamps so a snapshot can be reproduced.
Worked example
An auditor asks how privileged access is monitored under PCI DSS. Outcomes Navigator shows the relevant authentication use case as partially met: directory logs arrive, but privileged-group membership changes come only from a system whose logs were never onboarded. Reasoning: this is a data gap, not a rule gap. Remediate by onboarding the missing source and confirming the group-change field normalizes, then re-grade.
Traps
- Reporting an outcome as covered because content exists, ignoring whether the data is parsed.
- Assuming default retention satisfies a regulator without checking the configured period.
- Quoting coverage percentages without framework or ATT&CK mapping behind them.
- Never re-running the assessment after onboarding new sources.