coverage_list_mappings
List telemetry-to-MITRE mappings by event source and ID to identify covered event sources and view session statistics.
Instructions
List all known telemetry-to-MITRE mappings (Event ID → Data Source/Component). Use to see which event sources/IDs the coverage engine understands. Also shows session statistics.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| event_source_filter | No | Filter by event source (e.g., "sysmon", "windows_security", "mde") |