Question

Your SOC leadership wants a single, defensible way to report which adversary behaviors the detection program can currently observe, and to prioritize where to invest engineering effort next quarter. You maintain roughly 400 active detection rules in Google SecOps. Which approach BEST communicates detection coverage and highlights meaningful gaps to leadership?

Accepted Answer

Map each detection rule to MITRE ATT&CK techniques and build a coverage heatmap weighted by the tactics and techniques most relevant to your threat model

Answer

Report the total count of active detection rules and the month-over-month growth in rule count

Answer

Report the average number of alerts generated per detection rule per day across the fleet

Answer

Report the percentage of ingested log volume that is successfully parsed into UDM