Coverage, in practice

What it means

In an investigation, coverage describes the evidence that was actually available for a question. It includes the systems and identities represented, the time interval, event types, collection status, and any query or export limits. A query returning no matches has a different meaning when the source was healthy and complete than when half the devices never reported. Coverage should travel with the finding so another analyst can understand its limits. Broader uses of the word, such as detection coverage, should likewise define what is covered and how that claim was tested.

See the idea / Evidence

A search is only as complete as its collection.

Follow the remaining audit page, or stop with a known gap. Compare the conclusions.

Synthetic app A150 retains stable snapshot S150: three audit rows for U150 on September 30, 08:00 inclusive–10:00 exclusive UTC. Nora asks whether any row records Export. Page one returns two nonmatching rows and a cursor for the remaining page. The source’s accuracy, event logging and completeness within this snapshot are controlled assumptions. Other sources are outside this view.

01 / 04

Define scope

Nora asks about Export by U150 in one app’s two-hour audit snapshot. No rows have been collected.

More about this step

S150 is a retained, stable three-row snapshot of A150 audit records. The query is account U150, action Export and September 30 08:00 inclusive–10:00 exclusive UTC. Completeness and accurate event logging inside that source are assumed for this exercise; endpoint records, other apps and later arrivals are outside the claim.

Keep in mindAll pages means all rows of this selected snapshot, not all activity everywhere. A successful page or query can leave a known gap. A recorded Export does not prove malicious intent, file contents or a human’s identity. Delayed, unlogged or other-source activity is not ruled out.

Read the visual, step by step

Follow all pages

Define scope. Nora asks about Export by U150 in one app’s two-hour audit snapshot. No rows have been collected. S150 is a retained, stable three-row snapshot of A150 audit records. The query is account U150, action Export and September 30 08:00 inclusive–10:00 exclusive UTC. Completeness and accurate event logging inside that source are assumed for this exercise; endpoint records, other apps and later arrivals are outside the claim.
First page. Page one returns two nonmatching rows and a next-page cursor. The export collection is still incomplete. Nora reads the first API page, with a two-row limit. R150 records Login at 08:00; R151 records UpdateSettings at 08:30. Both belong to U150. The response names S150, reports three total rows and supplies opaque cursor S150-p2. Receiving two valid rows does not collect the third. No query or conclusion has yet been recorded.
Continue. Nora follows S150-p2. The final page returns R152, an Export at 09:30, and ends the collection. The complete run follows the genuine S150-p2 cursor for this unchanged snapshot. It receives R152: Export by U150 at 09:30 UTC. The empty next cursor and three distinct retrieved IDs agree with the reported total. The comparison deliberately stops after page one. The retained source is identical; R152 still exists even though the partial collection has not received it.
Query + report. The query finds one Export. Nora records complete collection of S150 and keeps the source boundary beside the result. The selected batch runs the account/action/time query over the retrieved rows and saves a scoped report. Following both pages finds R152; stopping early finds zero retrieved matches with one known unread row. This chapter combines query and report, not delivery to another person. S150 and originals remain unchanged. No business approval or malicious intent is inferred from Export.

Stop after page one

Define scope. Nora asks about Export by U150 in one app’s two-hour audit snapshot. No rows have been collected. S150 is a retained, stable three-row snapshot of A150 audit records. The query is account U150, action Export and September 30 08:00 inclusive–10:00 exclusive UTC. Completeness and accurate event logging inside that source are assumed for this exercise; endpoint records, other apps and later arrivals are outside the claim.
First page. Page one returns two nonmatching rows and a next-page cursor. The export collection is still incomplete. Nora reads the first API page, with a two-row limit. R150 records Login at 08:00; R151 records UpdateSettings at 08:30. Both belong to U150. The response names S150, reports three total rows and supplies opaque cursor S150-p2. Receiving two valid rows does not collect the third. No query or conclusion has yet been recorded.
Stop early. Nora stops with S150-p2 unread. Two retrieved rows remain a partial view of three retained rows. The complete run follows the genuine S150-p2 cursor for this unchanged snapshot. It receives R152: Export by U150 at 09:30 UTC. The empty next cursor and three distinct retrieved IDs agree with the reported total. The comparison deliberately stops after page one. The retained source is identical; R152 still exists even though the partial collection has not received it.
Query + report. The query finds zero matches in two retrieved rows. Nora records incomplete collection; that cannot rule out an Export. The selected batch runs the account/action/time query over the retrieved rows and saves a scoped report. Following both pages finds R152; stopping early finds zero retrieved matches with one known unread row. This chapter combines query and report, not delivery to another person. S150 and originals remain unchanged. No business approval or malicious intent is inferred from Export.

All pages means all rows of this selected snapshot, not all activity everywhere. A successful page or query can leave a known gap. A recorded Export does not prove malicious intent, file contents or a human’s identity. Delayed, unlogged or other-source activity is not ruled out.

Flow references: NIST SP 800-92: log collection, analysis and validation · Google AIP-158: follow pagination to the end

AN ILLUSTRATIVE SCENARIO

One missing audit page changes the finding

Nora checks stable snapshot S150 for Export by U150 from 08:00 inclusive to 10:00 exclusive UTC. Page one contains two nonmatching rows and a next cursor; page two contains R152, an Export at 09:30. Following the cursor finds one match in all three source rows. Stopping early finds zero retrieved matches with a known gap. Neither conclusion covers other sources or proves intent.

Put it to work

Write the investigative question and identify the sources that could answer it. Record required event types, systems, identities, time range, time zone, and expected data-delivery delay.
Check collection health, retention, filters, pagination, row limits, sampling, and failed queries. Distinguish a source that returned no matching events from a source that was unavailable or never enabled.
Attach a concise coverage statement to the conclusion and preserve the query or collection method. Seek alternate evidence where gaps matter, and state which uncertainty remains unresolved.

How to check your work

Use a known test event within the selected time range and confirm it appears in the expected source. Exercise pagination or a deliberately small limit, then ensure the final report explicitly identifies incomplete sources instead of converting them into zero findings.

Connect the ideas

Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.
Recall
Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.

Coverage