Skip to content
ENExplore Calculators

Detection Rule Coverage Calculator

Score how much of your detection content is actually enabled, fed with telemetry, tuned and tested — not just written.

About Detection Rule Coverage Calculator

Enabled and fed multiply rather than add, because a rule missing its log source contributes exactly nothing no matter how well written it is. Tuning, validation and source onboarding then adjust the score for whether the content is trustworthy and complete. Rule counts are the most gameable metric in security — a library of 400 rules where 100 have no telemetry and 200 have never been tuned is worse than 80 rules that all fire correctly, because it manufactures false confidence.

Formulas

Detection Rule Coverage

Effective coverage = 0.5 × (enabled% × fed-with-telemetry%) + 0.2 × tuned% + 0.2 × validated% + 0.1 × source-onboarding%.

enabled%
Authored rules switched on in production
fed%
Enabled rules whose required log sources exist
tuned%
Rules reviewed for false positives in 90 days
validated%
Rules proven to fire by adversary emulation

Silent rule count

Silent rules = enabled rules − rules receiving their required telemetry.

silent rules
Enabled but structurally incapable of firing

Worked example

With the default values below, Detection Rule Coverage Calculator returns Effective Detection Coverage of 61.4%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Detection rules authoredaccepts 1–100,000 rules
420 rules
Rules enabled in productionaccepts 0–100,000 rules
355 rules
Enabled rules receiving required telemetryaccepts 0–100,000 rules
300 rules
Rules tuned in the last 90 daysaccepts 0–100,000 rules
210 rules
Rules validated by purple-team or emulationaccepts 0–100,000 rules
165 rules
Log source types required by the rule setaccepts 1–1,000 source types
32 source types
Log source types onboardedaccepts 0–1,000 source types
25 source types

Results

Effective Detection Coverage
61.4%
Rules Enabled
84.5%
Enabled Rules With Telemetry
84.5%
Rules Tuned in 90 Days
50.0%
Rules Validated
39.3%
Log Source Onboarding
78.1%
Rules That Cannot Fire
55 rules
Detection Content Grade
C — Fair

Step by step

  1. 1Values used
  2. 2Detection Rule Coverage
  3. 3Silent rule count
  4. 4Effective Detection Coverage= 61.4
  5. 5Rules Enabled= 84.5
  6. 6Enabled Rules With Telemetry= 84.5
  7. 7Rules Tuned in 90 Days= 50.0
  8. 8Rules Validated= 39.3
  9. 9Log Source Onboarding= 78.1

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Detection Rule Coverage calculated?

Effective coverage = 0.5 × (enabled% × fed-with-telemetry%) + 0.2 × tuned% + 0.2 × validated% + 0.1 × source-onboarding%. Enabled and fed multiply rather than add, because a rule missing its log source contributes exactly nothing no matter how well written it is. Tuning, validation and source onboarding then adjust the score for whether the content is trustworthy and complete.

Why does Detection Rule Coverage matter?

Rule counts are the most gameable metric in security — a library of 400 rules where 100 have no telemetry and 200 have never been tuned is worse than 80 rules that all fire correctly, because it manufactures false confidence.

What values do I need to enter?

This calculator takes 7 inputs: Detection rules authored, Rules enabled in production, Enabled rules receiving required telemetry, Rules tuned in the last 90 days, Rules validated by purple-team or emulation, Log source types required by the rule set, Log source types onboarded. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why weight telemetry so heavily?

Because it is the only binary factor. A rule with no source data has a 0% chance of detecting anything, and this is the most common gap found during purple-team exercises — content deployed for a source that was never onboarded, or onboarded and later broken.

What counts as validated?

The rule fired end-to-end on a real emulated technique — Atomic Red Team, Caldera or a manual purple-team run — and produced an alert an analyst saw. A unit test on sample log lines is useful but is not validation.

Related Calculators

Detection Rule Coverage Calculator | Calcrivo