Detection metrics

- MTTD (mean time to detect) by severity - Alert volume and fidelity (true positive rate) - Detection coverage (MITRE ATT&CK heatmap) - Threat hunting findings (per hunt, value) - Log source coverage and health