Listing technique IDs is not a coverage analysis. The real question is whether that technique is visible in your environment.
Appending an ATT&CK table to the end of a report is a common habit. On its own the table tells the reader nothing about what can actually be detected.
Add three columns
- Data source — which log is needed to see this technique?
- Status — is that log collected, retained, and for how long?
- Detection — is there a rule, and when was it last validated?
Those three columns turn the table from an inventory into a list of actions.
The coverage fallacy
"We cover 140 of 200 techniques" is not a measure. Techniques are not equally weighted and one technique may have dozens of sub-variants. Measure coverage against the techniques used by actors who actually target you, not against a count.
Validation
Writing a rule is not detection. Validate that the rule fires with a controlled test at least once a year, and record the validation date in the table.
