Detection Coverage
How much of the relevant threat behavior an organization can actually detect, measured by which attacker techniques, log sources, and assets are covered by working detections. Gaps in coverage are blind spots attackers can exploit.
Concept Neighborhood
Start here
Detection Lifecycle
The most substantial related concept here, covered by 17 lessons.
Detection LifecycleStart here
17
lessons
Multi-Source Correlation
9
lessons
Rule Logic Design
7
lessons
Telemetry Mapping
7
lessons
Endpoint Telemetry
6
lessons
Events
6
lessons
Show 31 more connections
Logs
6
lessons
Sub-Techniques
6
lessons
Telemetry
6
lessons
Alert Design
5
lessons
Alert Triage Methodology
5
lessons
Baseline Analysis
5
lessons
Credential Dumping Indicators
5
lessons
DNS-Based Detection
5
lessons
First-Seen Detection
5
lessons
Log Source Gaps
5
lessons
Log Source Taxonomy
5
lessons
Mean Time to Detect (MTTD)
5
lessons
SOC Metrics That Matter
5
lessons
True Positive Rate
4
lessons
Regression Testing
3
lessons
Test Coverage
3
lessons
Behavioral Detection
1
lesson
False Positives
1
lesson
Heat Map
1
lesson
Indicators of Attack
1
lesson
Log Gaps
1
lesson
Network Visibility
1
lesson
OpenTelemetry
1
lesson
Purple Team Exercises
1
lesson
Red Team Exercises
1
lesson
Security from Observability
1
lesson
Signature-Based Detection
1
lesson
Telemetry Gaps
1
lesson
Threat-Informed Coverage
1
lesson
Tuning Anti-Patterns
1
lesson
Visibility Gap Operationalization
1
lesson
Related Lessons
6 lessons cover this conceptStore, Query, and Govern Telemetry
General Beginner
SIEM Data Models and Log Normalization
SOC Analyst
Aggregation and Statistical Analysis for Threat Detection
SOC Analyst
Time-Series Analysis and Multi-Source Correlation
SOC Analyst
Query Tuning, Lookup Tables, and Production Operations
SOC Analyst
Designing a Detection Program with SIEM Queries
SOC Analyst
Sign in to open lesson content directly.