• File size measurements show the distribution of size of files.
• Files are classified in four categories based on their size (lines of code): 1-100 (very small files), 101-200 (small files), 201-500 (medium size files), 501-1000 (long files), 1001+(very long files).
• It is a good practice to keep files small. Long files may become "bloaters", code that have increased to such gargantuan proportions that they are hard to work with.

• There are 1,718 files with 169,942 lines of code.
• 2 very long files (2,277 lines of code)
• 2 long files (1,234 lines of code)
• 32 medium size files (8,700 lines of codeclsfd_ftr_w_mp_ins)
• 666 small files (82,520 lines of code)
• 1,016 very small files (75,211 lines of code)

There are 1567 files with lines longer than 120 characters. In total, there are 26834 long lines.

File	# lines	# units	# long lines
initial_access_microsoft_365_abnormal_clientappid.toml in rules/integrations/o365	109	-	43
command_and_control_suspicious_network_activity_from_unknown_executable.toml in rules/linux	191	-	41
persistence_ec2_security_group_configuration_change_detection.toml in rules/integrations/aws	145	-	40
defense_evasion_sqs_purge_queue.toml in rules/integrations/aws	137	-	38
credential_access_ssh_backdoor_log.toml in rules/linux	149	-	35
initial_access_ml_auth_rare_source_ip_for_a_user.toml in rules/ml	122	-	34
credential_access_ml_suspicious_login_activity.toml in rules/ml	122	-	34
credential_access_ml_linux_anomalous_metadata_process.toml in rules/ml	117	-	34
credential_access_ml_auth_spike_in_logon_events.toml in rules/ml	125	-	34
credential_access_ml_linux_anomalous_metadata_user.toml in rules/ml	118	-	34
discovery_ml_linux_system_network_configuration_discovery.toml in rules/ml	115	-	34
execution_shell_via_meterpreter_linux.toml in rules/linux	123	-	34
defense_evasion_chattr_immutable_file.toml in rules/linux	116	-	34
persistence_xdg_autostart_netcon.toml in rules/linux	131	-	34
discovery_virtual_machine_fingerprinting.toml in rules/linux	113	-	34
defense_evasion_log_files_deleted.toml in rules/linux	127	-	34
discovery_linux_hping_activity.toml in rules/linux	119	-	34
privilege_escalation_linux_suspicious_symbolic_link.toml in rules/linux	123	-	34
defense_evasion_hidden_shared_object.toml in rules/linux	109	-	34
ml_packetbeat_rare_server_domain.toml in rules/ml	100	-	33
command_and_control_ml_packetbeat_rare_dns_question.toml in rules/ml	116	-	33
command_and_control_ml_packetbeat_rare_urls.toml in rules/ml	120	-	33
ml_linux_anomalous_network_port_activity.toml in rules/ml	100	-	33
privilege_escalation_ld_preload_shared_object_modif.toml in rules/linux	115	-	33
execution_unusual_pkexec_execution.toml in rules/linux	126	-	33
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	33
persistence_kde_autostart_modification.toml in rules/linux	212	-	33
defense_evasion_disable_selinux_attempt.toml in rules/linux	116	-	33
defense_evasion_attempt_to_disable_syslog_service.toml in rules/linux	117	-	33
discovery_linux_nping_activity.toml in rules/linux	119	-	33
command_and_control_beaconing.toml in rules/integrations/beaconing	92	-	32
discovery_ml_linux_system_network_connection_discovery.toml in rules/ml	115	-	32
discovery_ml_linux_system_process_discovery.toml in rules/ml	115	-	32
persistence_ml_windows_anomalous_process_all_hosts.toml in rules/ml	169	-	32
persistence_ml_windows_anomalous_process_creation.toml in rules/ml	157	-	32
ml_high_count_network_denies.toml in rules/ml	94	-	32
command_and_control_ml_packetbeat_rare_user_agent.toml in rules/ml	117	-	32
execution_ml_windows_anomalous_script.toml in rules/ml	116	-	32
privilege_escalation_ml_linux_anomalous_sudo_activity.toml in rules/ml	123	-	32
ml_rare_destination_country.toml in rules/ml	98	-	32
command_and_control_ml_packetbeat_dns_tunneling.toml in rules/ml	108	-	32
persistence_ml_rare_process_by_host_windows.toml in rules/ml	158	-	32
discovery_ml_linux_system_user_discovery.toml in rules/ml	114	-	32
resource_development_ml_linux_anomalous_compiler_activity.toml in rules/ml	118	-	32
credential_access_promt_for_pwd_via_osascript.toml in rules/macos	107	-	32
command_and_control_frequent_egress_netcon_from_sus_executable.toml in rules/linux	117	-	32
impact_potential_bruteforce_malware_infection.toml in rules/linux	134	-	32
lateral_movement_telnet_network_activity_internal.toml in rules/linux	117	-	32
lateral_movement_unusual_remote_file_creation.toml in rules/linux	118	-	32
lateral_movement_remote_file_creation_world_writeable_dir.toml in rules/linux	111	-	32