Question

Your SOC leadership claims MITRE ATT&CK coverage is at 82% based on the number of enabled detection rules mapped to techniques. During a recent red team exercise, several techniques that were counted as 'covered' generated no alerts. Which improvement to your observability program most directly addresses the discrepancy between reported coverage and actual detection effectiveness?

Accepted Answer

Track a validated-coverage metric that only credits a technique as covered after an atomic/purple-team test confirms the mapped rule actually fires on representative telemetry

Answer

Increase the count of enabled detection rules per technique to raise the mapped-coverage percentage above 90%

Answer

Report coverage strictly by the number of distinct log sources ingested per MITRE tactic

Answer

Switch the coverage dashboard to display alert volume per technique instead of rule-to-technique mappings