Detection coverage

Having logs is not having detections, and having detections is not having ones that work.

Those are three separate states and organisations routinely report the first while believing the third. Coverage is best expressed against the behaviours you care about: for this technique, do we collect the data, do we have a rule, and has it been tested against a real example. Most estates discover large gaps the first time they ask it that way.