Method

Every figure on this site is computed at build time from the snapshots listed here. Nothing is hand-entered. This page is meant to let a sceptical reader reproduce the headline numbers from the published data.

Sources and snapshots for this build

The raw snapshots are committed to the build repository on every run, so any past build can be reproduced exactly.

Definitions — fixed, and stated once

Mapped

A KEV CVE with at least one CTID mapping object of any mapping_type — exploitation_technique, primary_impact or secondary_impact — in either ATT&CK Enterprise or Mobile domain files. This is the more generous of the two defensible readings; it was chosen once and will not be changed quietly. The stricter figure, counting only exploitation_technique, is 410 of 1748 (23.5%) and is shown wherever the headline appears. uncategorized objects are ignored (there are none in the current files).

Stale

Mapped, and at least one mapped Enterprise technique ID is revoked, deprecated, or absent in ATT&CK v20.0. A technique that merely changed name is flagged on the page but does not make the entry stale. Mobile-domain mappings are not checked against the Enterprise bundle and never trigger staleness.

Unmapped

No CTID mapping object for the CVE. The page shows CISA's fields and nothing else. No technique is displayed for an unmapped CVE anywhere on the site, including Sigma rules' technique tags on that CVE's page.

Sigma coverage

For mapped CVEs only. Full: every live mapped Enterprise technique has ≥1 SigmaHQ rule whose tags include exactly attack.<technique id, lowercase>. Partial: some do. None ("mapped but uncovered"): none do. Parent-technique tags do not count for sub-techniques. Deprecated Sigma rules (under deprecated/) are excluded; rules under every rules*/ directory are included.

Added since snapshot

dateAdded strictly later than the latest CTID KEV snapshot date (2025-07-28).

Log source

The name field of an analytic's x_mitre_log_source_references entry, slugified. There is no log-source object type in ATT&CK; these are embedded structures. Channels are the channel field verbatim.

KEV CVEs reachable from a log source

CVEs with a mapping to a technique that has a detection strategy containing an analytic that references the log source.

The traversal

attack-pattern  ◀──[relationship: detects]──  x-mitre-detection-strategy
                                                   │ x_mitre_analytic_refs[]
                                                   ▼
                                              x-mitre-analytic
                                                   │ x_mitre_log_source_references[]  { name, channel, x_mitre_data_component_ref }
                                                   ▼
                                              x-mitre-data-component

Integrity observed in v20.0: 703 live detects relationships over 706 live techniques (3 live techniques without one); 1770 analytics; 4206 log-source references, every one resolving to a data component. The build fails if any reference dangles. The build also asserts one worked example on every run: T1055.011 ← DET0217 → AN0608 (Windows) → WinEventLog:Sysmon EventCode=10 → DC0035 Process Access.

Reproducing the headline

1. Download /data/kev-coverage.json. Count entries: 1748. Count s != "unmapped": 424. Divide: 24.3%.
2. Or from the sources: union the capability_id values across the CTID KEV mapping files listed above (the Enterprise and Mobile files for the newest ATT&CK version, plus older files — 0 CVEs appear only in an older file), intersect with KEV cveIDs. 424 distinct CVEs are mapped; 424 of those are in today's KEV.
3. For "added since snapshot": filter KEV by dateAdded > "2025-07-28": 357 entries; of those, 0 appear in the mapping files.
4. For Sigma: walk every rules*/**/*.yml, yaml.safe_load_all, collect tags matching ^attack\.t\d{4}(\.\d{3})?$. 3323 of 3793 rules carry one; 400 distinct techniques. CVE tags match ^cve\.\d{4}-\d{4,}$: 208 rules, 145 distinct CVEs, yielding 199 (CVE, technique) pairs over 126 CVEs — which is why Sigma is used here as technique → detection content and not as a CVE → technique source.

Things this site deliberately does not do

• Infer techniques from CWE via CAPEC. Reproduced and rejected.
• Infer techniques with a language model. Reported accuracy against expert labels is too low to present as knowledge; if an inferred layer is ever added it will be a separate, labelled, human-reviewable dataset, never merged into the authoritative one.
• Transfer a stale mapping to the technique that superseded it. ATT&CK records the supersession; nobody has re-reviewed the CVE against it.
• Accept an asset inventory. Scope.

Known limitations

• Mobile-domain mappings (45 objects, 5 CVEs mapped only in Mobile) count toward "mapped" but get no detection chain; only the Enterprise bundle is traversed.
• CISA KEV's licence is not explicitly stated; it is treated as US Government public domain. See licences.
• "Mapped" means a public source made a claim, not that the claim is correct. CTID's mappings carry comments and references, which are shown so you can judge.
• Sigma coverage is by tag only. A rule tagged with a technique may or may not detect the specific exploitation of a specific CVE; a technique with zero tagged rules may still be covered by rules that simply lack the tag.
• Log-source names are MITRE's verbatim. Where MITRE spells the same source two ways, two pages exist.