Microsoft describes an AI workflow for finding detection gaps

Microsoft published an AI-assisted detection-analysis workflow on 29 January. It extracts potential attacker behaviours from reports, maps them to the MITRE ATT&CK framework and compares them with an organisation’s detection catalogue. The inputs can include threat reports, red-team findings and other documents.

The workflow combines similarity search with model-based checks to suggest coverage and gaps. Microsoft frames the output as a starting point for an analyst. A matching detection name is not evidence that the necessary telemetry exists, or that a rule works against the observed behaviour. The proposed benefit is reducing initial sorting and mapping work so analysts can spend more time testing detections and examining the actual environment.