- Get Started with Outcomes Navigator
- Use Outcomes Navigator with the MITRE ATT&CK® Framework
- Use Outcomes Navigator with the Threat Detection, Investigation, and Response (TDIR) Use Case Categories Framework
- Use Outcomes Navigator for Compliance
- View Recommendations for Improving Your Configuration
- Share Information in Outcomes Navigator
- Outcomes Navigator Coverage Calculation
- The Role of Parsed Fields in Coverage Calculation
- Prerequisites for Calculating Coverage
- Types of Coverage Scores
- Use Case Coverage Score
- MITRE Coverage Score
- Compliance Framework Coverage Score
- Control Coverage Score
- OWASP Agentic AI Coverage Score
- OWASP Risk Coverage Score
- Advanced Analytics Rules Coverage Calculation
- Correlation Rules Coverage Calculation
- Dashboards Coverage Calculation
- Coverage Over Time Calculation
- Outcomes Navigator Parser Calibration Tier Average Calculation
Coverage Over Time Calculation
Learn how Outcomes Navigator creates the Coverage Over Time chart on the Organizational Coverage tab.
The Coverage Over Time chart depicts the Use Case Coverage Score for a specific use case, MITRE Coverage Score for a specific MITRE ATT&CK® technique, Control Coverage Score for a specific compliance control, or OWASP Risk Coverage Score for a specific security risk over the past six months. Each bar of the chart represents the average coverage score for each month.[19]
To get the monthly average, Outcomes Navigator calculates the coverage score for each use case, ATT&CK technique, security control, and security risk once per day. First, Outcomes Navigator checks if it has started calculating the average coverage score for the month. If not, Outcomes Navigator starts a new calculation for the month. If it has already started a calculation, Outcomes Navigator updates the existing calculation.
The monthly average coverage score is calculated by:
where A is the monthly average, M is the existing sum of coverage scores calculated during the month, D is the new coverage score calculated that day, and N is the number of times the coverage score was calculated that month. If Outcomes Navigator is starting a new calculation for the month, M is zero.
[19] MITRE ATT&CK and ATT&CK are trademarks of The MITRE Corporation ("MITRE"). Exabeam is not affiliated with or sponsored or endorsed by MITRE. Nothing herein is a representation of the views or opinions of MITRE or its personnel.