> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/review-mitre-att-and-ck-framework-coverage.md). # Review MITRE ATT\&CK framework coverage You can see a comprehensive overview of the Cortex XDR content and capabilities in context with the MITRE ATT\&CK framework on the **MITRE ATT\&CK Framework Coverage** dashboard. Access the dashboard from the drop-down menu in the dashboard header. On this dashboard you can see a breakdown of the protection modules and detection rules in place for each MITRE tactic and technique. You can use the dashboard to review the elements that affect your coverage, and identify coverage gaps in your framework. You can see the following information: * **Number of detection rules per tactic:** Review the detection rules that are available for each MITRE tactic. * **MITRE ATT\&CK framework coverage:** Review the MITRE matrix detailing the available coverage for each tactic and technique. By default, covered methods are displayed. Click on a tactic or technique for details about the available prevention and detection methods. Note that the Protection numbers represent modules, which are a grouping of several protections. * **Contributing data source types:** Review the connectivity status of the data sources that are contributing to a specific data source type on your system.

Note

When a contributing data source type is active, it does not imply that all the rules and detectors associated with the data source type are active. Rule applicability is dependent on the data source's context and configuration. To enable an active status, data source types require the following setup:

In addition, if you are working with reports, you can use the **MITRE Coverage Report** widget, which summarizes coverage for each tactic. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/review-mitre-att-and-ck-framework-coverage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.