| name | detection-coverage-analysis |
| description | Analyzes detection coverage using Sigma, Splunk, and Elastic rules. Use when checking coverage for techniques, tactics, threat actors, or generating Navigator layers from detections. |
Detection Coverage Analysis
Efficient Tools (Use These!)
Get Coverage Stats
analyze_coverage(source_type: "elastic")
Returns coverage % by tactic, top techniques, weak spots.
Find Gaps by Threat Profile
identify_gaps(threat_profile: "ransomware")
identify_gaps(threat_profile: "apt")
identify_gaps(threat_profile: "persistence")
Returns prioritized P0/P1/P2 gaps with recommendations.
Get Detection Suggestions
suggest_detections(technique_id: "T1059.001")
Returns existing detections, data sources needed, detection ideas.
Generate Navigator Layer
generate_navigator_layer(
name: "Elastic Initial Access",
source_type: "elastic",
tactic: "initial-access"
)
Returns ready-to-import Navigator JSON.
Get Just Technique IDs
get_technique_ids(source_type: "elastic", tactic: "persistence")
Returns ~200 bytes instead of ~50KB.
Threat Profiles Available
| Profile | Key Techniques |
|---|
| ransomware | T1486, T1490, T1027, T1547 |
| apt | T1003, T1021, T1053, T1071 |
| initial-access | T1566, T1190, T1078 |
| persistence | T1547, T1543, T1053 |
| credential-access | T1003.*, T1555, T1552 |
| defense-evasion | T1027, T1070, T1055 |
DON'T (burns tokens)
# BAD - returns 200+ full detection objects
list_by_mitre_tactic(tactic: "execution")
DO (efficient)
# GOOD - returns stats only
analyze_coverage(source_type: "elastic")
Token Comparison
| Old Approach | New Approach |
|---|
| list_by_mitre_tactic → ~50KB | analyze_coverage → ~2KB |
| Parse in context | Done server-side |
| 25x more tokens | Efficient |
