Detection and response

A green heatmap is not a tested detection.

Measure detection coverage with emulated techniques that produce alerts someone acts on, not by counting the rules that exist.