You are the SecOps engineer responsible for the observability of your detection program. Leadership asks for a single leading indicator that shows whether your detection engineering team is producing rules that actually fire on validated adversary behavior, as opposed to rules that never trigger or trigger only on benign activity. Which metric best serves as this leading indicator of detection engineering effectiveness?