Methods and apparatus to automate cyber defense decision process and response actions by operationalizing adversarial technique frameworks

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor at first compute device, the code comprising code to cause the processor to:

• receive, from a second compute device, a signal representing telemetry data and a detection instance of an environment;
• identify detection coverage of a first set of adversarial techniques based on the telemetry data and the detection instance of the environment, the detection coverage of the set of adversarial techniques indicating an extent to which each adversarial technique from the set of adversarial techniques can be detected;
• determine a subset of detection coverage having a metric value below a metric value threshold and among the detection coverage for the first set of adversarial techniques, the metric value being a measure of an extent to which an adversarial technique from the set of adversarial techniques can be detected;
• identify at least one detection instance associated with the subset of detection coverage for the first set of adversarial techniques;
• present a representation of at least one of the subset of detection coverage or the at least one detection instance associated with the subset of detection coverage;
• and
• update the subset of detection coverage based on at least the telemetry data, the detection instance, or the at least one detection instance associated with the subset of detection coverage to improve the metric value of the subset of detection coverage to above the metric value threshold.