Rule counts overstate coverage.
Two numbers decide whether a detection program is working: how much of the attack surface the live rules really cover, and whether the alerts they raise fit in the hours the analysts have. Both are on this page, and both move when you move the levers.
Coverage#
Each rule counts as its Summiting the Pyramid level divided by 5. A tactic held up by seven rules that match a tool's filename scores below one held up by four rules that match the behavior. Raise the minimum level and watch the brittle rules drop out.
Alert budget#
A rule's run cost is the alerts it raises times the minutes each one takes to triage. Set your own numbers and the page works out what fits, what the precision floor is, and what has to give when it does not.
The levers open on the sample program: 30 rules at 1.5 alerts a day each, 14 minutes a triage, three analysts with two hours. It does not fit, which is the usual starting position.
The cap is the framework default of 120 minutes.
Program snapshot#
The sample program's measured numbers, with its 30-day precision checked against the floor your levers just set.
Definitions#
Fifteen numbers, each defined once and owned by one stage. The repository produces the build-side ones from score.yml and the file layout; the rest come from what analysts record about each alert.
Chart data: metrics.json written by tools/metrics.py. Definitions: framework.json v, CC BY 4.0. ATT&CK pin . Level mix per tactic is spread from each tactic's weighted total, so the bars match metrics.json exactly.