How to Measure Detection Coverage Before You Trust It

Most security teams can say how many detections they have. Fewer can say how many of those detections actually work with the telemetry sitting in their environment right now.

In one detection coverage assessment, UltraViolet Cyber's Threat Intelligence & Detection Engineering (TIDE) team identified a validated path to raise mapped MITRE ATT&CK technique coverage from 59 of 222 techniques (26.6%) to 136 of 222 (61.3%). That's a potential gain of 34.7 percentage points, or roughly a 130% relative increase, with the recommended detections expected to add that coverage without raising SOC alert volume.

That assessment came from Equinox, TIDE's in-house detection engineering platform. Here's what it actually does and how the process works.

What "covered" usually means, and what it should mean

A detection rule showing up in your SIEM doesn't mean it fires. Vendor libraries often include thousands of rules, but whether any given one is relevant depends on your data, your tech stack, and your risk profile. Whether it actually works depends on something more specific: does your environment send the fields that rule needs?

Confirming that by hand, across every rule and every log source, can take weeks. Equinox does it in under 30 minutes.

A mapped detection rule isn't a working detection until the telemetry behind it is confirmed.

How the assessment works

Equinox inventories every detection and log source already in place, then inspects the available fields and schemas to confirm which detections the data can actually support. It maps that picture to MITRE ATT&CK and MITRE ATLAS, using sector-specific threat models so the assessment focuses on techniques relevant to that customer rather than the full matrix.

From there, it checks existing vendor detections first, since most organizations already own more detection capability than they're using. Where no suitable vendor detection exists, it flags the gap for a custom detection.

From gap to deployed detection

This is where a human enters the process. Every candidate detection, vendor or custom, is backtested against 30 days of historical data before it ships. Anything that would generate more than 30 alerts in that window gets held for additional tuning instead of going live as-is.

Coverage improvements should control alert volume, not add to it.

A TIDE engineer reviews, prioritizes, and approves every recommendation before deployment. Nothing is enabled automatically. Practitioner-led and AI-accelerated: automation provides the speed, engineers provide the judgment.

Covering more than MITRE ATT&CK

Equinox also maps detections to MITRE ATLAS, the framework for threats to and from AI systems. As organizations bring more AI into their environments, this identifies the telemetry needed, things like data pipeline and AI/LLM API logs, to support detections against AI-specific attack techniques. Most detection engineering platforms haven't built this in yet.

One picture across every platform you run

Security teams running multiple SIEMs or EDR tools usually end up with separate coverage pictures for each one, then have to cross-reference them by hand. Equinox maps coverage across every supported platform into a single MITRE view. SentinelOne, CrowdStrike, Elastic, and Panther are supported today, with Splunk and Microsoft Defender in development.

What this looks like ongoing

Equinox is included with UltraViolet Cyber's Managed SOC service at no added cost, with an assessment during onboarding and a reassessment every quarter as frameworks, threats, and telemetry change. It's also available as a standalone engagement for teams running their own SOC or working with another MDR provider who want an independent view of their coverage.

Reports come out in two forms: an executive summary covering the changes and next steps, and a technical report detailing every new rule and the techniques it covers. Both are built for use in QBRs and audit conversations, not just internal review.

Want the full breakdown, including the live Q&A on SIEM connections and custom detection builds? Watch the on-demand webinar: More Coverage from the Security Stack You Already Have.