ATT&CK coverage

ATT&CK coverage is the share of MITRE ATT&CK techniques a set of detections maps to. It shows intent: which techniques a rule is meant to catch. It does not show that the rule works, so pair it with testing and rule health before trusting the number.

What ATT&CK coverage means here

Products read ATT&CK tags on each rule and draw a matrix. Some add simulated coverage, counting rules available but not enabled.

A technique has many variants and a single rule rarely covers all of them. Treat a filled cell as a starting claim to test.

Example of ATT&CK coverage in Elastic Security documentation

Elastic's MITRE ATT&CK coverage page documents mapping custom rules to ATT&CK in Advanced settings, and the TOML rule file carries a threat field for the same mapping. elastic.co read 2026-11-03

Terms related to ATT&CK coverage

• Coverage gap: A coverage gap is an ATT&CK technique, or a part of the estate, with no detection or no working detection.
• Data source coverage: Data source coverage is which log sources are onboarded, and whether the rules that need them can run.
• Synthetic event: A synthetic event is a log record generated to look like the result of a specific attack behaviour, used to test whether a detection fires.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.