pr-extension-workflow

name	PR Extension Workflow
description	Analyze pull requests for detection coverage gaps and recommend additional detections, story alignments, and test coverage to extend PRs before merge.

PR Extension Workflow Skill

Overview

When a PR adds new detections, there are often opportunities to extend coverage before merge — additional sub-techniques, missing analytic story associations, untested scenarios, or related detections that should ship together. This skill provides a systematic workflow for analyzing and extending detection PRs.

PR Analysis Workflow

Step 1: Inventory the PR

Examine every detection file in the PR:

• Detection count: How many new/modified detections?
• Techniques covered: Which MITRE ATT&CK technique IDs?
• Data sources used: Which log sources and fields?
• Story associations: Which analytic stories are referenced?
• Severity levels: Distribution of severity ratings

Step 2: Identify Coverage Gaps

For each technique in the PR, check:

1. Sub-technique coverage — If the PR covers T1059 (Scripting), does it cover the important sub-techniques? (.001 PowerShell, .003 Windows Command Shell, .007 JavaScript)
2. Tactic coverage — Does the technique appear under multiple tactics? Are all relevant tactics addressed?
3. Platform coverage — If the technique applies to Windows AND Linux, does the PR cover both?
4. Evasion variants — Does the detection only catch the obvious case, or does it handle obfuscation/encoding?

Step 3: Check Story Alignment

For each detection:

1. Is it associated with at least one analytic story?
2. Does a relevant story already exist that this should be added to?