Closing Detection Gaps and Metrics

Purple teaming generates rich data, but without metrics it is just anecdotes. Metrics turn exercises into a defensible improvement story for leadership and budget owners.

• They show whether defenses are actually getting better
• They prioritize where to invest limited engineering effort
• They make abstract 'security posture' concrete and trackable

The goal is not a high score for its own sake, but measurable, sustained improvement against relevant threats.

The headline metric is detection coverage: the share of tested techniques that produced an alert.

Compute it per tactic and overall:

Coverage percentages can mislead. Only counting techniques you chose to test inflates the number, and counting a brittle rule as 'covered' overstates real defense.

• Coverage should be measured against a threat-relevant technique set, not a cherry-picked one
• A 'detected' result must come from a robust, behavior-based rule
• Logged-only outcomes are not coverage; they are potential coverage

Always pair the percentage with the denominator: '80% of FIN7 techniques' means far more than a bare '80%'.

Speed matters as much as visibility. Two time metrics capture defensive responsiveness:

• MTTD — Mean Time To Detect: action timestamp to alert timestamp
• MTTR — Mean Time To Respond: alert to containment action

Because purple teaming records the exact moment each technique runs, you can measure these precisely instead of estimating from messy incident data.

Not every gap deserves equal urgency. Rank gaps by risk, combining how likely the technique is and how damaging it would be.

• High likelihood + high impact (e.g. LSASS dumping) = fix first
• Low likelihood + low impact = backlog
• Weigh by whether the technique appears in your threat intel

A simple scoring of likelihood times impact gives an ordered remediation list that focuses effort where it reduces the most real-world risk.

Before writing a rule, diagnose why the gap exists. The fix differs depending on the root cause:

• No telemetry — enable the missing data source (e.g. Sysmon config, script block logging)
• Telemetry but no rule — write a detection
• Rule exists but did not fire — fix the logic or filter that suppressed it
• Alert fired but ignored — a process/triage problem, not a content gap

Fixing a logic bug is wasted effort if the underlying log was never collected.

The most fundamental gap is missing data. For example, PowerShell script block logging is enabled via Group Policy or registry to make Event ID 4104 available.

With telemetry in place, write the detection and tune for signal. Untuned rules drown analysts in false positives and get ignored.

• Start broad to confirm the artifact appears
• Add exclusions for known-good baseline activity
• Measure the false-positive rate against normal traffic
• Re-run the emulation to confirm it still catches the attack

A detection is 'done' only when it reliably fires on the attack and stays quiet on benign activity.

Single-exercise numbers are a snapshot; trends tell the real story. Track coverage and MTTD across quarters.

• Q1: 45% coverage, MTTD 22 min
• Q2: 62% coverage, MTTD 14 min
• Q3: 71% coverage, MTTD 9 min

An improving trend demonstrates that purple teaming is paying off. A flat or declining trend signals detection decay or that fixes are not landing.

Detections break silently as environments change. Treat them like code and test for regressions.

• Re-run previously passing techniques each cycle
• Automate continuous validation so broken detections raise an alert
• Version-control detection content and review changes

A detection that quietly stopped firing is arguably worse than never having it, because the team believes they are covered when they are not.

Tailor reporting to the audience. Engineers need technique-level detail; leadership needs outcomes and risk.

• For engineers: per-technique results, rules created, tuning notes
• For leadership: coverage trend, MTTD trend, top risks closed and remaining
• Visual: an ATT&CK Navigator heatmap showing progress over time

Framing results as risk reduction, not raw technical data, is what sustains support and funding for the program.

Test your understanding of closing gaps and metrics.

You can now measure and improve detection coverage rigorously:

• Use coverage, MTTD, and MTTR as core metrics, always with their denominator
• Avoid coverage illusions from cherry-picked or brittle detections
• Root-cause each gap before fixing: telemetry, rule, logic, or triage
• Enable missing data, then tune rules for low false positives
• Track trends and guard against silent detection regression
• Report as risk reduction with ATT&CK heatmaps to sustain the program

You have completed the Purple Teaming course: bridging red and blue into a continuous, measurable loop that makes defenses provably better.