-
-# :material-shield-search: WinLogKit
-
-
-
----
-
-## Why WinLogKit
-
--**WinLogKit** turns the Yamato Security -logging baselines into something you can actually deploy: enable the right -Windows events, prove they're being recorded, and roll back if you change -your mind - plain PowerShell, no agents. -
- -
-[:material-rocket-launch: Get started in 10 minutes](getting-started.md){ .md-button .md-button--primary }
-[:material-radar: See your ATT&CK coverage](mapping.md){ .md-button }
-[:fontawesome-brands-github: View on GitHub](https://github.com/spydisec/WinLogKit){ .md-button }
-
-
-
-
-
-
-Out of the box, Windows supports only 10-20% of Sigma detection rules, and -default log sizes of 1-20 MB mean evidence is quickly overwritten -(Yamato's guide). -
- -
-
-- :material-backup-restore:{ .lg .middle } __Deploy with an exit ramp__
-
- ---
-
- Preview everything with `-WhatIf`; an automatic pre-change backup means
- one command rolls it all back.
-
-- :material-check-decagram:{ .lg .middle } __Prove it, don't assume it__
-
- ---
-
- Per-category PASS/FAIL with evidence CSVs, plus Yamato's
- [WELA](https://github.com/Yamato-Security/WELA) as an independent
- second opinion.
-
-- :material-chart-box:{ .lg .middle } __Decide volume with numbers__
-
- ---
-
- The [ATT&CK coverage report](mapping.md) (current MITRE v19.2 data)
- measures each tier - Heavy buys 98% of the native ceiling.
-
-- :material-table-sync:{ .lg .middle } __One table, every target__
-
- ---
-
- Intune packs, WEF subscriptions and GPO artefacts all compile from one
- settings table - deployed config can't drift from the tested baseline.
-
-
-
-## What it targets
-
-Windows Server 2019 / 2022 / 2025 and Windows 10 / 11 workstations,
-standalone or domain-joined. Version- and role-specific items are detected
-at runtime and reported NOT APPLICABLE where they don't apply. Baselines
-ship as reviewable CSVs: reference sets (ASD, Microsoft), per-role starting
-points, and the blended `spydi_*` Minimal/Heavy pairs -
-[all documented with sources and event IDs](baselines.md).
-
-## Privacy
-
-The kit is a **static snapshot**: the Yamato baselines and the MITRE ATT&CK
-mapping data are vendored with recorded provenance. Nothing is fetched at
-runtime, and nothing about your hosts, results or baselines ever leaves
-them. The single optional network action is `Invoke-WELACheck.ps1 -Download`,
-which fetches WELA from GitHub to your machine when you explicitly ask.
-
-## Credits
-
-Settings and baselines come from Yamato Security's
-[EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings),
-[WELA](https://github.com/Yamato-Security/WELA) and
-[EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide);
-ATT&CK mapping data from [MITRE ATT&CK](https://github.com/mitre-attack/attack-stix-data)
-with approach credit to OTRF's [OSSEM-DM](https://github.com/OTRF/OSSEM-DM).
-This project is affiliated with none of them. MIT licensed; deviations from
-upstream are documented with reasons.
-
-!!! warning "Test before you trust"
- Logging volume costs disk and money. Run any baseline on a mirror of
- production for a week, then use the coverage and volume numbers to
- decide what stays.
+--8<-- "README.md"
diff --git a/docs/mapping.md b/docs/mapping.md
index 57d60a1..34daf8a 100644
--- a/docs/mapping.md
+++ b/docs/mapping.md
@@ -1,9 +1,145 @@
-# ATT&CK Coverage Mapping
-
-One question, answered with numbers: **if I turn these settings on, which
-attack techniques could my logs actually see - and for the rest, why not?**
-`Export-AttackCoverage.ps1` computes it locally for any baseline, offline,
-from data shipped in the kit.
+# Coverage
+
+Two questions, answered from data shipped in the kit: **how do the pieces
+fit together**, and **if I turn these settings on, which attack techniques
+could my logs actually see, and for the rest, why not?**
+`Export-AttackCoverage.ps1` computes the second one locally for any
+baseline, offline.
+
+## How the pieces fit
+
+How the kit works under the hood, in one picture. The claim it makes:
+**all configuration derives from a single settings table (coverage
+additionally reads the shipped ATT&CK snapshot), snapshots come in once
+with their dates recorded, and events flow out to your collector - the kit
+never talks to the internet at runtime.** The two opt-in exceptions fetch
+a tool only when you ask: `Invoke-WELACheck.ps1 -Download` and the
+[Autoruns add-on](addons.md) installer's `-Download`.
+
+