Coverage gap

A coverage gap is an ATT&CK technique, or a part of the estate, with no detection or no working detection. A gap can be real, because no rule exists, or apparent, because the rule exists but the data to feed it is missing. Telling the two apart matters.

What Coverage gap means here

A matrix with empty cells shows candidate gaps. The next question is whether telemetry for the technique reaches the SIEM at all.

Close apparent gaps by fixing ingestion and real gaps by writing or buying rules.

Example of Coverage gap in Hunters documentation

In Hunters' Threat Coverage map a gray technique means currently not covered, and the docs add that gray cells can also reflect missing telemetry. docs.hunters.ai read 2026-11-03

Terms related to Coverage gap

• ATT&CK coverage: ATT&CK coverage is the share of MITRE ATT&CK techniques a set of detections maps to.
• Data source coverage: Data source coverage is which log sources are onboarded, and whether the rules that need them can run.
• Content library: A content library is a vendor- or community-maintained set of ready-made detections.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.