Detection Rule Coverage Calculator

Effective coverage = 0.5 × (enabled% × fed-with-telemetry%) + 0.2 × tuned% + 0.2 × validated% + 0.1 × source-onboarding%. Enabled and fed multiply rather than add, because a rule missing its log source contributes exactly nothing no matter how well written it is. Tuning, validation and source onboarding then adjust the score for whether the content is trustworthy and complete.

Rule counts are the most gameable metric in security — a library of 400 rules where 100 have no telemetry and 200 have never been tuned is worse than 80 rules that all fire correctly, because it manufactures false confidence.

This calculator takes 7 inputs: Detection rules authored, Rules enabled in production, Enabled rules receiving required telemetry, Rules tuned in the last 90 days, Rules validated by purple-team or emulation, Log source types required by the rule set, Log source types onboarded. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because it is the only binary factor. A rule with no source data has a 0% chance of detecting anything, and this is the most common gap found during purple-team exercises — content deployed for a source that was never onboarded, or onboarded and later broken.

The rule fired end-to-end on a real emulated technique — Atomic Red Team, Caldera or a manual purple-team run — and produced an alert an analyst saw. A unit test on sample log lines is useful but is not validation.