• File size measurements show the distribution of size of files.
• Files are classified in four categories based on their size (lines of code): 1-100 (very small files), 101-200 (small files), 201-500 (medium size files), 501-1000 (long files), 1001+(very long files).
• It is a good practice to keep files small. Long files may become "bloaters", code that have increased to such gargantuan proportions that they are hard to work with.

• There are 1,614 files with 160,389 lines of code.
• 2 very long files (2,193 lines of code)
• 2 long files (1,226 lines of code)
• 32 medium size files (8,742 lines of codeclsfd_ftr_w_mp_ins)
• 636 small files (78,831 lines of code)
• 942 very small files (69,397 lines of code)

There are 1464 files with lines longer than 120 characters. In total, there are 25245 long lines.

File	# lines	# units	# long lines
initial_access_microsoft_365_abnormal_clientappid.toml in rules/integrations/o365	108	-	43
command_and_control_suspicious_network_activity_from_unknown_executable.toml in rules/linux	191	-	41
persistence_ec2_security_group_configuration_change_detection.toml in rules/integrations/aws	145	-	40
defense_evasion_sqs_purge_queue.toml in rules/integrations/aws	137	-	38
discovery_linux_hping_activity.toml in rules/linux	114	-	35
credential_access_ssh_backdoor_log.toml in rules/linux	151	-	35
initial_access_ml_auth_rare_source_ip_for_a_user.toml in rules/ml	122	-	34
credential_access_ml_suspicious_login_activity.toml in rules/ml	122	-	34
credential_access_ml_linux_anomalous_metadata_process.toml in rules/ml	117	-	34
credential_access_ml_auth_spike_in_logon_events.toml in rules/ml	125	-	34
credential_access_ml_linux_anomalous_metadata_user.toml in rules/ml	118	-	34
discovery_ml_linux_system_network_configuration_discovery.toml in rules/ml	115	-	34
execution_shell_via_meterpreter_linux.toml in rules/linux	123	-	34
defense_evasion_chattr_immutable_file.toml in rules/linux	118	-	34
persistence_xdg_autostart_netcon.toml in rules/linux	131	-	34
discovery_virtual_machine_fingerprinting.toml in rules/linux	113	-	34
defense_evasion_log_files_deleted.toml in rules/linux	129	-	34
privilege_escalation_linux_suspicious_symbolic_link.toml in rules/linux	123	-	34
defense_evasion_hidden_shared_object.toml in rules/linux	111	-	34
defense_evasion_disable_selinux_attempt.toml in rules/linux	111	-	34
defense_evasion_attempt_to_disable_syslog_service.toml in rules/linux	113	-	34
discovery_linux_nping_activity.toml in rules/linux	114	-	34
ml_packetbeat_rare_server_domain.toml in rules/ml	100	-	33
command_and_control_ml_packetbeat_rare_dns_question.toml in rules/ml	116	-	33
command_and_control_ml_packetbeat_rare_urls.toml in rules/ml	120	-	33
ml_linux_anomalous_network_port_activity.toml in rules/ml	100	-	33
privilege_escalation_ld_preload_shared_object_modif.toml in rules/linux	115	-	33
execution_unusual_pkexec_execution.toml in rules/linux	124	-	33
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	33
persistence_kde_autostart_modification.toml in rules/linux	214	-	33
defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml in rules/linux	115	-	33
command_and_control_beaconing.toml in rules/integrations/beaconing	92	-	32
discovery_ml_linux_system_network_connection_discovery.toml in rules/ml	115	-	32
discovery_ml_linux_system_process_discovery.toml in rules/ml	115	-	32
persistence_ml_windows_anomalous_process_all_hosts.toml in rules/ml	171	-	32
persistence_ml_windows_anomalous_process_creation.toml in rules/ml	159	-	32
ml_high_count_network_denies.toml in rules/ml	94	-	32
command_and_control_ml_packetbeat_rare_user_agent.toml in rules/ml	117	-	32
execution_ml_windows_anomalous_script.toml in rules/ml	118	-	32
privilege_escalation_ml_linux_anomalous_sudo_activity.toml in rules/ml	123	-	32
ml_rare_destination_country.toml in rules/ml	98	-	32
command_and_control_ml_packetbeat_dns_tunneling.toml in rules/ml	108	-	32
persistence_ml_rare_process_by_host_windows.toml in rules/ml	160	-	32
discovery_ml_linux_system_user_discovery.toml in rules/ml	114	-	32
resource_development_ml_linux_anomalous_compiler_activity.toml in rules/ml	118	-	32
lateral_movement_telnet_network_activity_internal.toml in rules/linux	119	-	32
credential_access_ml_windows_anomalous_metadata_user.toml in rules/ml	115	-	31
discovery_ml_linux_system_information_discovery.toml in rules/ml	115	-	31
persistence_ml_windows_anomalous_service.toml in rules/ml	116	-	31
discovery_users_domain_built_in_commands.toml in rules/macos	120	-	31