Sentinel's MITRE coverage doc updated, still in preview
Microsoft updated the Sentinel MITRE ATT&CK coverage page on 2026-08-12. It is still in preview and aligned to ATT&CK v18 (Microsoft Learn, read 2026-11-04).
The page shows a matrix of active rules and simulated coverage from rules that are available but not configured. In the Defender portal it adds a ratio of active detections to recommended ones. Preview status means the feature can change.
Source: learn.microsoft.com read 2026-11-04
What it changes for a buyer
Use the matrix as a planning view and keep the preview label in any report. A filled cell shows a rule mapped to a technique, not a technique tested.
All notes are in the changelog. Spotted something wrong? See corrections.