Identity-Telemetry Portfolio Design from MITRE ATT&CK Detection Analytics: Exact Frontiers and Single-Component Dependency Stress Tests

Security teams must prioritize telemetry collection, but technique-level coverage counts do not show whether the evidence declared by a detection analytic is available in a selected portfolio or how strongly that support depends on individual components. This study formulates identity-telemetry selection as an exact portfolio problem using MITRE ATT&CK Enterprise Detection Strategies, Analytics, and Data Components. A prespecified name rule identified 18 active identity components. A strategy was conditionally supported (identity-side) when at least one associated Analytic had all its identity-component requirements in the portfolio, assuming that all nonidentity requirements are available. Exhaustive enumeration calculated nominal support and support under a single-component omission stress test across ATT&CK releases 18.0–19.2, together with a lower-bound measure that counts only Analytics declaring no nonidentity requirements. Each release contained 150 eligible strategies. In release 19.2, six components supported 129 strategies (86.0%), seven 135 (90.0%), ten 144 (96.0%), and fifteen all 150. Complete collection retained only 111 strategies (74.0%) after omission of the most damaging component; Logon Session Creation, User Account Authentication, and Logon Session Metadata accounted for losses of 39, 30, and 17 strategies. Only 123 of 326 eligible Analytics were identity-only, and the lower-bound measure reached at most 41 strategies (27.3%). Adjacent releases shared an optimum at every budget, although two of the four release pairs had identical identity mappings. Two alternative identity ontologies and a Windows-only scenario preserved the gap between nominal and omission-stress support. The outcome is a structural mapping benchmark, not evidence of deployability or detection efficacy.