update links and content

docs/README.md

@@ -7,8 +7,8 @@ This project gives you access to our repository of Analytic Stories that are sec
 
 ## View Our Content
 
-* [Analytic Stories](docs/stories.md)
-* [Detections](docs/detections.md)
+* [Analytic Stories](https://github.com/splunk/security_content/tree/develop/docs/stories.md)
+* [Detections](https://github.com/splunk/security_content/tree/develop/docs/detections.md)
 
 If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):
 
@@ -34,7 +34,7 @@ If you want to help the rest of the security community by sharing your own detec
 * [detections/](https://github.com/splunk/security_content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
 * [response_tasks/](https://github.com/splunk/security_content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
 * [responses/](https://github.com/splunk/security_content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
-* [baselines/](https://github.com/splunk/security_content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+
 
 #### Content Spec Files
 * [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.spec.md)
@@ -42,6 +42,16 @@ If you want to help the rest of the security community by sharing your own detec
 * [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.spec.md)
 * [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.spec.md)
 * [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.spec.md)
-* [baselines](https://github.com/splunk/security_content/blob/develop/docs/spec/baselines.spec.md)
 * [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.spec.md)
 * [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.spec.md)
+
+# MITRE ATT&CK ⚔️
+### Detection Coverage
+To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+
+![](https://github.com/splunk/security_content/blob/develop/docs/mitre-map/coverage.png)
+
+### Detection Priority by Threat Actors
+If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer in [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/). Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.
+
+![](https://github.com/splunk/security_content/blob/develop/docs/mitre-map/priority.png)