Edilec's offline CLI maps analyst-confirmed activity and detection observations to a JSON coverage report, CSV summary, and ATT&CK Navigator layer. It preserves separate detected, not-detected, and unknown counts with source ordinals. It never infers technique IDs from notes or treats unknown detection as successful monitoring.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/attack-coverage-mapper.mjs --help
node bin/attack-coverage-mapper.mjs --dataset examples/dataset.json --activities examples/pass.json --out-dir /tmp/attack-coverage-pass-outputRead the result
Use a fresh output directory on each run; an existing reserved artifact is refused. Output paths may contain spaces. The examples use independently authored synthetic IDs, statuses, version and source declarations; they are schema fixtures, not official ATT&CK releases. Supply your own correctly prepared local subset and activity evidence for real work.