# Provenance coverage

Auto-generated by `scripts/build_provenance.py`. Do not edit by hand.

_Generated 2026-05-03T12:08:41Z — 6,565 use cases audited._

## How provenance is classified

Every UC's `References` field is parsed for URLs; each URL is tagged
with a source category and the UC's *primary origin* is the most
authoritative category among its citations. The priority ladder is:

| Rank | Category | Description |
| ---- | -------- | ----------- |
| 10 | `splunk-official` | Splunk (official docs / Splunkbase) |
| 9 | `vendor-official` | Vendor (official product docs) |
| 8 | `mitre-attack` | MITRE (ATT&CK / CWE / CAPEC) |
| 7 | `nist-compliance` | Standards (NIST / CIS / ISO / PCI / OWASP / CERTs / IETF) |
| 6 | `threat-intel` | Threat intel (vendor research + community TTP projects) |
| 5 | `splunk-blog` | Splunk (blog / marketing) |
| 4 | `community` | Community (blogs / repos / forums) |
| 3 | `unclassified` | URL not matching any known vendor / standards body |
| 1 | `contributor` | No external citation — authored by contributors |

## Overall coverage

| Origin | UCs |
| ------ | --- |
| Splunk official (`splunk-official`) | 4,570 (69.6%) |
| Vendor official (`vendor-official`) | 583 (8.9%) |
| MITRE ATT&CK (`mitre-attack`) | 346 (5.3%) |
| Standards (`nist-compliance`) | 144 (2.2%) |
| Threat intel (`threat-intel`) | 469 (7.1%) |
| Splunk blog (`splunk-blog`) | 47 (0.7%) |
| Community (`community`) | 142 (2.2%) |
| Other (`unclassified`) | 264 (4.0%) |

## Coverage by top-level category

| Category | Total | Splunk | Vendor | MITRE | Standards | Threat-intel | Blog | Community | Other | Contributor |
| -------- | ----- | ------ | ------ | ----- | --------- | ------------ | ---- | --------- | ----- | ----------- |
| Cat 1 | 275 | 275 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 2 | 176 | 133 | 6 | 0 | 0 | 0 | 0 | 0 | 37 | 0 |
| Cat 3 | 129 | 115 | 0 | 0 | 0 | 0 | 0 | 0 | 14 | 0 |
| Cat 4 | 227 | 227 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 5 | 374 | 358 | 5 | 0 | 0 | 0 | 0 | 0 | 11 | 0 |
| Cat 6 | 81 | 81 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 7 | 122 | 122 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 8 | 106 | 106 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 9 | 104 | 104 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 10 | 2,409 | 630 | 572 | 300 | 93 | 469 | 47 | 142 | 156 | 0 |
| Cat 11 | 107 | 107 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 12 | 88 | 88 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 13 | 143 | 143 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 14 | 230 | 230 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 15 | 81 | 81 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 16 | 81 | 81 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 17 | 105 | 105 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 18 | 76 | 76 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 19 | 72 | 72 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 20 | 77 | 77 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 21 | 129 | 129 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Cat 22 | 1,310 | 1,167 | 0 | 46 | 51 | 0 | 0 | 0 | 46 | 0 |
| Cat 23 | 63 | 63 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |