A SOC manager reviews the observability dashboard and notices that the security operations platform is processing a steady 40,000 alerts per day with a stable false-positive rate. However, the security engineering team just confirmed that a new business-critical SaaS application went live two weeks ago and is not yet onboarded as a log source. The manager wants a single metric that best reflects whether the platform can actually detect threats against the organization's environment, rather than just how busy it is. Which metric should the manager prioritize on the dashboard?