Behavior Analysis Coverage Calculator

telemetryScore = 0.24×process + 0.20×memory + 0.16×file + 0.16×network + 0.12×registry + 0.12×script; overall = 0.55×telemetry + 0.30×ruleCoverage + 0.15×precision. Process creation with command lines carries the most detection value per byte, and in-memory visibility is weighted almost as high because fileless and injection techniques leave nothing else behind. Rules matter separately from telemetry — perfect visibility with no behavioural logic detects nothing — and precision is included because an analyst who closes four alerts in ten as noise stops reading the tenth. The result is a weighted prioritisation estimate of where to invest, not assurance that anything specific will be caught.

Coverage gaps are systematic rather than random: whichever telemetry source is weakest defines the technique class your adversary can use with impunity.

This calculator takes 9 inputs: Process and command-line telemetry, File and module load telemetry, Registry and persistence telemetry, Host network connection telemetry, In-memory and injection telemetry, Script-block and interpreter logging, Behavioural rules mapped to techniques, Techniques you intend to detect, Alerts closed as false positive. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because the techniques that defeat everything else — reflective loading, process injection, in-memory .NET execution — are only observable there. An estate with perfect file telemetry and no memory telemetry is blind to the modern default tradecraft.

It is a floor, not a target. Well-covered techniques need several rules for different procedures, so mature programmes run well above 100% on this ratio. Treat the figure as a rough completeness signal and validate with adversary emulation instead.