Track a Sigma rule set from applicable to converted to deployed, and find where field mapping loses your detections.
The multiplication by field-mapping completeness is the important part: a rule that converts and deploys but references an unmapped field is syntactically valid and functionally dead. That failure mode is silent, which is why deployed rule counts overstate coverage so consistently. Sigma makes detection portable in principle, but the value only lands if rules survive conversion, mapping and deployment — and the losses at each stage are where a 3,000-rule repository becomes 640 working detections.
Sigma Rule Coverage
Effective coverage = deployed rules ÷ applicable rules × field-mapping completeness.
Pipeline loss
Rules lost = applicable − deployed, split across conversion failures and deployment backlog.
Effective coverage = deployed rules ÷ applicable rules × field-mapping completeness. The multiplication by field-mapping completeness is the important part: a rule that converts and deploys but references an unmapped field is syntactically valid and functionally dead. That failure mode is silent, which is why deployed rule counts overstate coverage so consistently.
Sigma makes detection portable in principle, but the value only lands if rules survive conversion, mapping and deployment — and the losses at each stage are where a 3,000-rule repository becomes 640 working detections.
This calculator takes 6 inputs: Sigma rules in the source repository, Rules applicable to your platforms and log sources, Rules that convert cleanly to your backend, Rules deployed and enabled, Deployed rules validated by emulation, Taxonomy fields mapped to your schema. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the repository covers every platform, product and cloud provider. Filtering to your actual log sources typically leaves a third or less, and that is the correct denominator — coverage against the whole repository is a meaningless number.
Backend gaps around aggregation and correlation, unsupported field modifiers, regular-expression dialect differences, and case-sensitivity assumptions. Convert in CI and fail the build on conversion errors, so the gap is visible rather than discovered months later.