What the framework assumes
The framework rests on four premises about detection programs. It does not claim they hold everywhere; it is built for the programs where they do.
- The backlog of detection ideas is always longer than the team's capacity, so the order of work is a decision, and it should be made with numbers that can be argued with.
- Every live rule has a running cost, paid by analysts in triage minutes, and that cost is rarely written down next to the rule.
- A count of rules per tactic overstates coverage, because a rule that matches a tool's filename and a rule that matches the behavior itself count the same on a heatmap.
- Rules leave production far less often than they enter it, so the analysts end up triaging alerts from rules that nobody owns.