Module coverage 

Detection coverage: the rules matching a filter, grouped by MITRE ATT&CK technique, tactic, index pattern, or integration package, with enabled and disabled counts per group.

Structs

CoverageReport

Every group of the corpus read, sorted by enabled_rules descending, then disabled_rules descending, then key ascending in byte order.

CoverageRow

One group. name is set only for techniques and tactics, and tactics is filled only for techniques.

Enums

CoverageGroup

What a coverage row counts rules by.

Functions

coverage_from_rules

Group the rules by group_by.

detection_coverage

Read every rule matching filter with rules::find_window and group it. The corpus limit and the read conflict reach the caller unchanged.