What it means
In an investigation, coverage describes the evidence that was actually available for a question. It includes the systems and identities represented, the time interval, event types, collection status, and any query or export limits. A query returning no matches has a different meaning when the source was healthy and complete than when half the devices never reported. Coverage should travel with the finding so another analyst can understand its limits. Broader uses of the word, such as detection coverage, should likewise define what is covered and how that claim was tested.
AN ILLUSTRATIVE SCENARIO
A clinic checks for a suspicious download
A clinic investigates whether a user downloaded a large set of patient records. The application audit source covers the relevant two hours, but its export returns only the first ten thousand rows. Endpoint records are available for the office laptop but not the user's unmanaged tablet. The analyst completes the paginated application export and documents the missing tablet source. A statement that no matching endpoint event was found remains limited to the monitored laptop; it does not establish that no download occurred elsewhere.
Put it to work
- Write the investigative question and identify the sources that could answer it. Record required event types, systems, identities, time range, time zone, and expected data-delivery delay.
- Check collection health, retention, filters, pagination, row limits, sampling, and failed queries. Distinguish a source that returned no matching events from a source that was unavailable or never enabled.
- Attach a concise coverage statement to the conclusion and preserve the query or collection method. Seek alternate evidence where gaps matter, and state which uncertainty remains unresolved.
How to check your work
Use a known test event within the selected time range and confirm it appears in the expected source. Exercise pagination or a deliberately small limit, then ensure the final report explicitly identifies incomplete sources instead of converting them into zero findings.
Connect the ideas
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.
- Recall
Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.