Mitre's ATT&CK framework has many valuable features and characteristics, including the documentation of known threat actor groups and their associated attack techniques, as well as the breakdown of known attack techniques by tactic. One feature that is especially valuable is the cataloging of data sources that could be used to detect each individual attack technique. Roberto Rodriguez initially made the data sources to tools connection in his Threat Hunting blog posts "How Hot is your Hunt Team?" and "Ready to Hunt? First, Show me your Data!". By cataloging all of the data sources your current tools are able to look at (and potentially send to a centralized aggregator for ingestion), you can create a heat map of the known techniques, and how strong or weak your controls are per attack technique. This is effectively "Coverage", e.g. "I have these tools that should detect these techniques". But data sources and tools only represent one side of an effective Blue team, and does not take into consideration variables such as team talent per tool and talent constraints.This talk represents the past year's worth of work developing an attack-path effectiveness tool using the Mitre ATT&CK framework, and will walk through the logic and process it took to go from Attack-Path "Coverage" to Attack-Path "Effectiveness".