Practitioner deep-dive
Measuring the detection coverage you actually have.
Every operator I've worked alongside already lives the gap between a green coverage cell on a vendor heatmap and the 2am alert that never came, so the version of the coverage map I trust isn't the one that reports the percent of ATT&CK my rules nominally cover, it's the one that takes a specific attack chain, fires my actual compiled detections at it over data I control, and tells me which techniques fired clean, which fired and drowned the needle in noise, and which produced nothing at all. This essay is that map, run end to end and reported without rounding up.
Evidence tier B throughout: these are my own measurements on a synthetic testbed, a single machine, one APT29-style chain of eight techniques planted into an OCSF-shaped store I built and seeded deterministically (master_seed 20260601, the ground-truth fingerprint pinned, the run reproducible bit-for-bit). The transferable finding is the detected/noisy/missed split and the discipline of refusing to count an inferred lead as coverage, not the absolute eight-technique tally, which is bounded by whatever I chose to plant.
The join
ATT&CK to D3FEND, over OCSF, with the firing measured in the middle.
In the tools you can use today I walked the open detection-grounding stack bottom to top and stopped at one question: does the mapping hold together at design time. That essay answers whether the stack is sound to write detections against. This one asks the next question, the one an operator actually loses sleep over, which is that now I've written detections against it, how much of this attack chain do they catch when real telemetry moves through them, and how do I read that coverage without lying to myself. So I ran a detection through the same stack and measured.
The join has four moves, and the order matters because each move is a different kind of evidence. First, a Sigma rule references an ATT&CK technique: that's the design-time mapped structure, the same thing a vendor heatmap counts. Second, pySigma compiles that rule to SQL and runs it over the OCSF-shaped store, which I call Store F, where the events for this chain live under the relevant class uids (1007 process, 4003 dns, 4001 network, 3002 authentication, 6003 api). Third, the query either matches the planted needle or it doesn't, and I score that against ground truth: this is the measured firing, the part the heatmap never has. Fourth, where the rule fired nothing, the Security Context Graph names the D3FEND defenses that may counter the technique, and each of those edges carries a proxy_quality rank.
That fourth move is where the whole thing stays accurate or quietly cheats, so I want the discipline stated before any number lands. The graph uses the weakest-link rule I described in the tools essay: a multi-hop answer is only as trustworthy as its weakest edge, the intent-blind offense-to-defense inferences sit at trust 0.25, and an artifact_cooccurrence edge is a possibility of coverage, never a measured detection. D3FEND here is v1.4.0. The point of running a real detection through the stack rather than inventorying the stack is that the difference between a rule that fires and a defense that might apply is exactly the difference a coverage percent erases, and I'd rather measure it than assert it.
The measured read
Eight techniques, three states, scored not inspected.
The three states are measured runtime firing, not configuration inspection. Detected means the needle was in the matched set and precision was at or above the T=0.9 floor. Noisy means the needle was caught but precision fell below the floor, so the alert exists but a human can't use it. Missed means the rule didn't fire on the needle, or there was no rule or no needle to fire on. Here is the whole grid, one row per technique, exactly as the run scored it.
| ATT&CK | Stage | OCSF | Rule | State | Matches | FPs | Precision |
|---|---|---|---|---|---|---|---|
T1059.001 | execution | 1007 | encoded_powershell.yml | DETECTED | 1 | 0 | 1.0 |
T1071 | C2 | 4003 | c2_domain.yml | DETECTED | 1 | 0 | 1.0 |
T1098 | priv-esc | 6003 | nomfa_privesc.yml | DETECTED | 1 | 0 | 1.0 |
T1021 | lateral movement | 4001 | rdp_lateral.yml | NOISY | 2,960 | 2,959 | 0.0003 |
T1003.001 | credential access | 1007 | — | MISSED | 0 | 0 | 0.0 |
T1048 | exfiltration | 4001 | — | MISSED | 0 | 0 | 0.0 |
T1110 | credential access | 3002 | — | MISSED | 0 | 0 | 0.0 |
T1490 | impact | 1007 | — | MISSED | 0 | 0 | 0.0 |
Three fired clean. Encoded PowerShell on a named host, a resolution to a known-C2 domain, and an AttachUserPolicy call made without MFA each matched their needle with precision 1.0 and zero false positives. Those are the cells a heatmap and a measured run agree on, and they're worth naming because the measured read isn't pessimism for its own sake; when a rule is good, the measurement says so.
The tactic rollup is where the coverage percent starts to mislead. Reading down the stages, Credential Access is 0 for 2, since both T1003.001 (OS credential dumping) and T1110 (brute force) missed entirely, which makes it the worst-covered tactic on this chain. A single "62.5% covered" number would have buried that. An operator who needs to know where the chain breaks needs the tactic-level split, not the aggregate.
That a coverage percent overstates real efficacy is the predicted shape from the academic literature. Stefan Axelsson's "The Base-Rate Fallacy and the Difficulty of Intrusion Detection" (2000) is the formal reason a detector with a fine-looking true-positive rate still produces mostly false alarms when the base rate of the thing it hunts is low, and Robin Sommer and Vern Paxson's "Outside the Closed World" (IEEE S&P 2010) is the companion argument that adversarial settings and difficult base rates are exactly where machine-learned and rule-based detection struggle in the wild. The T1021 result below is the base-rate fallacy made measurable, not a surprise.
Covered is not effective
The RDP rule fired, and that's the problem.
T1021 is the centerpiece, because on a vendor heatmap this technique shows up green and handled, and the measurement says otherwise in a way the heatmap structurally cannot. The rdp_lateral.yml rule compiled, ran over the network class, and caught its needle, with true_positive equal to 1, so the lateral-movement event the chain planted was found. It also matched 2,959 benign port-3389 connections, because the rule keys on the kind of generic signal that every routine RDP session in the store satisfies. Total matches 2,960, false positives 2,959, precision 0.0003. The needle is in there, and it's indistinguishable from the haystack at the alert queue.
That's the SOC false-positive tax measured rather than assumed. A precision of 0.0003 means an analyst who chases this alert is wrong 9,996 times out of 10,000, and no SOC works that alert for long before muting it, at which point the one true positive it would have caught is gone too. The T=0.9 floor exists precisely to refuse to call this covered: the rule fired, so a config-inspection check would tick the box, and the firing measurement plus the precision floor together say no, this is noise wearing a detection's name. This is the data-layer version of the tooling-isn't-capability argument in the detection-maturity ladder, where the trap is buying HMM4 automation an HMM2 team can't tune; here the trap is counting a rule that fires as a rule that works.
I'm not the first to say coverage isn't effectiveness, and I want to be exact about who already owns which piece so the contribution here doesn't get overclaimed. Tidal Cyber's "Why Defensive Coverage Doesn't Equal Detection Effectiveness" (March 2026, a vendor blog, so read it with the bias flagged) puts the rhetoric in market cleanly: coverage measures presence, it doesn't measure performance. MITRE ATT&CK Evaluations is the strongest measured-firing prior art, grading each substep on a scale from none through telemetry to a full technique detection and reporting coverage ratios, except it measures vendor products in MITRE's own lab rather than your deployment and carries no schema-grounded provenance. ipurple.team's "Measuring Detection Coverage" (October 2024) already attaches per-technique confidence tiers gated on simulation, so trust-tiering isn't novel either. And Jared Atkinson's work at SpecterOps — the Funnel of Fidelity, the Capability Abstraction analysis of Kerberoasting, the Detection Spectrum — established that mapped isn't working and that coverage is layer-dependent. My add sits one layer below his abstraction spectrum: does the OCSF field the analytic reads even populate, and did the rule fire on it.
The honest holes
Four techniques produced nothing, and the join won't pretend otherwise.
Four techniques missed outright: T1003.001 (credential dumping), T1048 (exfiltration over an alternative protocol), T1110 (brute force), and T1490 (inhibit system recovery). No rule fired on the needle, so there is no detection to score. This is where the join earns its keep or quietly launders a number, and the discipline is the refusal to launder. For each missed technique the Security Context Graph offers leads — D3FEND defenses that may counter it — and it offers a lot of them: 10 for T1003.001, 26 for T1048, 25 for T1110, and 13 for T1490, which is 74 may-counter leads across the four.
Every one of those 74 is an intent-blind artifact_cooccurrence edge at trust 0.25, flagged weak, and zero of them survive the min_trust=0.6 soundness filter. So the read of the four holes is not that there are 74 defenses; it's that there are 74 inferred possibilities and no sound off-the-shelf detection among them. The benchmark's own note says it plainly: counters is not detects, and a may-counter lead is never collapsed into the detected count. The temptation a coverage tool faces is to take those 74 leads and report the technique as "addressed by available defenses," and that's the exact move the provenance rank exists to refuse.
The reason the leads are weak isn't arbitrary, it traces to how the underlying matrix was built. The 14,004-row ATT&CK-to-D3FEND mapping is artifact co-occurrence inference, not direct d3f:counters assertions: it says this defense touches an artifact this technique also touches, which is suggestive and not a claim that the defense detects the technique. That co-occurrence-not-counters character is precisely why each lead lands at 0.25 and none survives 0.6. The join doesn't get more confident than its weakest edge, and here the weakest edge is the only edge.
There's a schema-layer analog to these firing-layer holes, and it's worth seeing them side by side. My own measured map of how OCSF and D3FEND connect shows that while the two standards link at the class level, 97.7% of OCSF leaf attributes — the fields a detection actually keys on — are orphaned, with no D3FEND grounding at all. (That figure is SDW-measured and first-cut, not a community statistic, so cite it as mine.) A defender can only catch what the schema grounds, and grounding is thin at the leaf. Covered-isn't- effective at the firing layer and grounded-isn't-orphan at the schema layer are the same gap seen from two heights.
Grounding method · measured map
Where this sits
The differentiator is the join, not the idea.
I want to state the position as a join with the priors named, because the bare thesis is saturated and pretending otherwise would be the kind of overclaim this whole essay argues against. Three moves make this instrument: name the design-time mapped structure (a Sigma rule references a technique), measure whether it actually fires on real telemetry in your deployment, and attach a per-edge trust tier to each technique-to-detection link grounded in whether the OCSF class and field are populated. Evals measures vendor-lab firing. Tidal carries the rhetoric. ipurple carries the tiers. MITRE's CAR coverage page is the nearest same-framing prior art, an explicit mapped-coverage cross-walk across CAR, Sigma, Elastic, and Splunk by technique, openly a coverage map and openly not measured firing, with no trust tiers. Atkinson gave the vocabulary. Anton Chuvakin's writing on detection-in-depth and broken collectors as the cause of poor coverage is the practitioner framing I'm closest to, and I formalize one level below it, at the OCSF class and field. The spot none of them occupies is the OCSF-schema grounding of the firing measurement plus per-edge provenance back to the class and field, on your own deployment. That's the join. I'd defend it as a join, and I wouldn't defend a clean "nobody does this," because that claim is false and I can name the people it's false about.
The saturated angles I'm deliberately not claiming: that coverage isn't effectiveness and you can measure it (Tidal, the base-rate literature, and SpecterOps own that), that per-technique trust-tiering is novel (ipurple has it), and that validating your detections is a fresh idea (continuous validation is table stakes in every maturity model worth the name). What's left that I think is genuinely useful is narrow and I'd rather it be narrow and true: the firing measurement anchored in OCSF schema evidence, with each edge carrying provenance you can audit back to a class uid and a field.
And the limits, kept attached, because this is the empirical-honesty member of the family. This is tier B: one synthetic chain, a single machine, eight techniques bounded by what I chose to plant, so the absolute count is not the finding and I'd ask you not to read it as one. The finding that travels is the detected/noisy/missed split as a way to read a coverage map, and the refusal to count a may-counter lead as coverage. Two boundaries I hold hard. This is detect-phase only: the D3FEND view is design-time structure about what could counter a technique, and I make no runtime hop from a record to a working defense, because the measurement covers firing, not response. And the method and the measured result here are on synthetic data only, and there's no per-customer recommender in this essay and no paid scores, the engines named are the open ones (Sigma, ATT&CK, D3FEND, CAR), and where a commercial engine would sit I've kept it general and put no benchmark number beside it. What's reusable is the instrument and the discipline, run against your own store, your own rules, your own ground truth.