Playbook: Validating Detection Coverage

What’s inside

1. The short version
2. Why this playbook exists
3. What “covered” has to mean
4. The process at a glance
5. Step 1. Decide what you are validating, and what you are not
6. Step 2. Build the inventory
7. Step 3. Check telemetry before you test detections
8. Step 4. Test the behavior, and test more than one way
9. Step 5. Record the result for each test
10. Step 6. Grade honestly, and give grades an expiry
11. Step 7. Turn gaps into work
12. Measures that mean something
13. Where validation goes wrong
14. A 90-day plan

Sources are listed in the full practitioner field note.