Step 6 — telemetry
How much of your estate each log source actually covers, and what that makes structurally undetectable.
What this step establishes
This step asks how much of your estate each log source actually covers, then computes which of your in-scope behaviours are structurally undetectable — not under-detected, but impossible to detect with what you collect.
The question that moves the number
Not “do you have this source” but “what percentage of the estate does it cover”. Those are different questions and the gap between them is where most detection programmes actually live. A source deployed on 30% of hosts is not the same capability as one deployed everywhere and healthy, and reporting it as though it were is how a coverage metric becomes fiction.
This is usually the step where an assessment stops being comfortable. It is also the step that produces the most immediately actionable output, because the fixes are concrete: enable a channel, extend an agent rollout, forward a log that is already being written.
How the computation works
For each in-scope technique the model looks up the detection analytics ATT&CK publishes for it, reads the concrete log sources those analytics require, and takes the best coverage figure among them — because you need one working route, not all of them. The result is a band:
90% or more of the estate covered by a source that would record the behaviour.
60–89%. Real coverage, but an adversary operating outside it is unobserved.
Below 60%. Detection is possible and should not be relied on.
Nothing you collect would record it. No rule changes this.
Deception counts, conditionally
If you declared deception in step 1, it is credited here — but as a tripwire rather than as coverage. Credit is placement multiplied by operationalisation: a decoy sited where an adversary must go and monitored by someone who would act reaches partial; one placed wherever was convenient and watched by nobody is credited with nothing at all, and leaves the picture identical to declaring no deception.
What you get
- Every in-scope technique banded assured, partial, weak or blind
- Quick fixes ranked by what they unblock — each entry naming a source you are not collecting, how many of your in-scope techniques it would make detectable, the tool class, and a free route
- The specific behaviours you currently cannot see, with the sources that would fix each
- An “I have this” control, so you can model a change before committing to it