Coverage measurement evaluates which attacker behaviors a security team’s detections can identify and where monitoring gaps remain. It focuses on the behaviors covered, not simply the number of rules a team has written.
Defenders use it to assess and improve detection logic in a repeatable way. Teams can map rules to relevant behaviors, identify areas without effective monitoring, and test whether coverage depends on available log sources. Regular measurement helps reveal when changes to systems, data, or priorities have weakened detection, so rules can be reviewed and updated.