A SOC wants to understand which adversary techniques its detections cover and where telemetry gaps remain. Which framework view should it evaluate?

1. Only the number of dashboards
2. MITRE ATT&CK coverage with mapped data and detections
3. Only a resource naming convention
4. A guarantee that one rule covers every attack