Prioritizing detection rules in soc using mitre att&ck technique co-occurrence analysis

Security Operations Centers (SOCs) continuously expand detection content, yet limited engineering capacity makes it difficult to decide which detection rules should be implemented, tuned, or reviewed first. This paper proposes a knowledge-driven method for prioritizing detection rules using the MITRE ATT&CK framework and co-occurrence analysis of techniques. We construct a weighted technique co-occurrence graph from ATT&CK STIX that uses relationships across campaigns and intrusion sets, and quantify technique importance using graph centrality measures (eigenvector, betweenness, and closeness). We then assign each rule a Priority Score by aggregating the importance of ATT&CK techniques referenced by the rule, weighted by the technique's prevalence across threat entities. We evaluate the approach offline on two public rule corpora (Sigma and Elastic) using a train/test split of threat entities to avoid information leakage. Effectiveness is measured by Coverage@K and an importance-weighted variant that emphasizes centrally positioned techniques. The results show that frequency-only and centrality-only baselines are strong for maximizing unweighted technique coverage at small rule budgets, while the proposed Priority Score becomes more competitive under importance-weighted evaluation and can outperform baselines in selected settings. The findings indicate that technique co-occurrence centrality provides a transparent prioritization signal that aligns with emphasizing high-leverage techniques and suggest practical extensions, such as diversity-aware ranking and environment-specific calibration.