> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Coverage Explorer
> The tag-overlap visualiser inside Settings → Tags — find devices in multiple tags or no tags at all
The **Coverage Explorer** (full page at `/tag-coverage-explorer`) shows how your tags overlap across the device estate. It's the safety net for tag design — every time you change a Logic Engine rule, the Coverage Explorer tells you whether the result is what you expected. Reach it from the **Coverage Explorer** link in the top-right of [Settings → Tags](/settings/tags).
## What it shows
| View | What you see |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Overlap** | Which devices match *multiple* tags — useful for spotting unintended dual-membership (a device that's both `End-User` and `Server`) |
| **Uncovered** | Which devices match *zero* tags — typically your most actionable finding, because untagged devices have no Vitals scope |
| **Per-tag counts** | How many devices each tag currently includes |
The page header shows the total count (e.g. `1,229 devices`) and the "% of these devices have one or more tags" coverage metric. A side configuration panel lets you toggle **Show only active devices** and **Show only name based dynamic tags**.
## How to access it
[Settings → Tags](/settings/tags) from the Settings left rail.
Top-right of the Tags page. This opens the full Coverage Explorer page at `/tag-coverage-explorer`.
Drills through to the Devices grid filtered by the implied tag query — useful for sanity-checking individual devices.
## Why it matters
Tags drive **Vitals scope** (which controls a device is expected to have), **Action targeting** (which devices automations apply to), and **data-filter access** (who can see what). A misconfigured tag has cascading effects.
The Coverage Explorer surfaces three classes of problem before they cause noise:
1. **Devices in zero tags** — they sit outside Vitals scope entirely, so gaps don't show up as findings. Often the most consequential miss.
2. **Devices in conflicting tags** — e.g. a device tagged both `End-User` and `Server` may have contradictory Vitals requirements.
3. **Empty tags** — a Logic Engine rule that matches nothing usually means the query is wrong, not that the population is genuinely zero.
## When to use it
| Situation | Check |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
| **After any tag rule change** | Run Coverage Explorer to confirm the new rule's population looks right |
| **Day-one tag design** | Walk through every segment to confirm complete, non-overlapping coverage of your estate |
| **Monthly housekeeping** | Untagged devices accumulate as new devices arrive — review and re-rule monthly |
| **Investigating Vitals noise** | If Vitals are firing unexpectedly, an over-broad tag is often the cause; Coverage Explorer shows which tag membership is too generous |
## Best practices
Untagged devices are operationally invisible to Vitals and Actions. Either they need a tag (the rule was wrong) or they need an exclusion tag like `Stock` to mean *"intentionally out of scope right now"*. See [Tags & Logic Engine → Best practices](/tags-and-logic-engine#best-practices).
Coverage Explorer is the only fast way to see the impact of a rule change without scrolling Devices. Save the click trip.
Freshly-discovered devices that haven't been baselined yet should sit in a `Stock` tag where security controls aren't required. Coverage Explorer makes the move-out cadence visible.
## Cross-references
The full conceptual home of tags
Where Coverage Explorer lives
What tag-scoped Vitals look like
The grid Coverage Explorer drills into
Coverage Explorer, Tag, Logic Engine definitions
Day-one tag design