Purpose

When working in Main Coverage, Adaptive Report is designed to answer one question quickly: How strong is the overall model right now? It compresses a complex workbook into a small set of high-signal indicators and a tactic-level view, so you can steer priorities, communicate posture, and track improvement over time.

Core posture signals (KPIs)

The Main Coverage view is built around four core signals. Together they provide both breadth (coverage) and quality (consistency) across the Merlino model.

• Technique Coverage (TC): overall technique mapping and coverage across the in-scope ATT&CK technique set.
• Data Sources Coverage (DS): telemetry readiness—whether the required data sources are mapped and available to support reliable detections.
• Tests Coverage (TS): validation readiness—how much of the technique scope is backed by tests in the Merlino test catalogue.
• CrossPick (XP): a correlation indicator that reflects how consistently techniques are connected across tables (techniques ↔ data sources ↔ tests ↔ detections). Lower XP commonly indicates fragmented mappings or missing linkages that reduce confidence.

MITRE tactics analysis (radar)

The report includes a radar visualization that breaks down TC, DS, TS, and XP across MITRE tactics. This helps you see posture imbalance at a glance: strong tactic coverage in one area may not translate to validation or telemetry readiness in another. The radar is generated from your current workbook mappings, so it reflects the real state of the model rather than a static template.

What the radar helps you identify

• Gaps by tactic: tactics where coverage or validation is consistently weak.
• Readiness mismatch: tactics that are mapped (high TC) but lack telemetry or tests (low DS/TS).
• Prioritization targets: tactics where focused work will produce visible improvement fastest.
• Program balance: ensure effort is not concentrated only on early-phase tactics (e.g., Discovery) while ignoring late-phase ones (e.g., Exfiltration).

Refresh and export

Main Coverage is intended for continuous iteration. As you refine mappings, add data sources, and link tests, you can regenerate the dashboard and track changes immediately.

• Refresh: recalculates TC, DS, TS, XP and regenerates the MITRE tactics radar using the latest workbook state.
• Export as PNG: generates a clean image snapshot for documents, slides, tickets, and customer-facing reporting.

Typical uses

• Global posture snapshot: share a single view that summarizes coverage and confidence.
• Steering and prioritization: decide where to focus mapping, telemetry onboarding, and test development.
• Progress reporting: export periodic snapshots to demonstrate measurable uplift across the program.
• Quality control: use XP to detect fragmentation and improve consistency across your model.

Note: Main Coverage is methodology-driven and based entirely on workbook evidence. Improving results typically requires tightening the links between techniques, data sources, detections, and tests—so coverage becomes both broader and more defensible.