Data source coverage

Data source coverage is which log sources are onboarded, and whether the rules that need them can run. A technique is covered only if the rule and the right data both exist. It links the detection plan to the ingestion plan.

What Data source coverage means here

The view that helps lists, for each rule, the sourcetypes or tables it needs and whether they are flowing. Few products show it.

Without it, a coverage matrix overstates what you can detect.

Example of Data source coverage in Splunk Enterprise Security documentation

Splunk's Detection Studio page says engineers can identify data source gaps, and the use case library shows sourcetype and data model status per detection (product page, vendor claim). splunk.com read 2026-11-03

Terms related to Data source coverage

• Coverage gap: A coverage gap is an ATT&CK technique, or a part of the estate, with no detection or no working detection.
• Log source health: Log source health is whether each log source is sending data on time and in the expected shape.
• ATT&CK coverage: ATT&CK coverage is the share of MITRE ATT&CK techniques a set of detections maps to.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.