Work out mitre technique coverage instantly with clear inputs, formula shown and shareable results.
Technique coverage and tactic coverage answer different questions. Covering many techniques inside a few tactics leaves whole stages of the kill chain unobserved, so an intrusion passes through undetected regardless of the impressive technique count. Blending the two puts weight on breadth across tactics, which is what actually gives multiple chances to catch an intrusion.
Coverage blend
technique coverage = covered / total techniques; tactic coverage = tactics with any detection / tactics; score = mean of the two
Collection, exfiltration and impact, because they need data-flow and file-access telemetry rather than the process and authentication logs most teams start with.
No. Techniques have many procedures, so a single rule usually catches one implementation. Depth per technique matters as much as breadth across the matrix.