observability_log_pattern_miner
Read-onlyIdempotent
As a CTO, extract anomalous log patterns from public breach reports (e.g., Verizon DBIR) and MITRE ATT&CK techniques to optimize SIEM rules and observability pipelines. Inputs include threat actor groups, MITRE tactics (e.g., 'TA0005'), or log sources (e.g., 'AWS CloudTrail'). Outputs structured patterns with MITRE mappings, prevalence scores, and detection recommendations. Ideal for reducing false positives and improving breach detection coverage. Pass async:true to avoid timeout.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| async | No | If true, returns a job_id immediately (<200ms) instead of waiting for the result. Poll the result with job_result(job_id). Use for slow tools to avoid client timeouts. | |
| tactic | Yes | MITRE ATT&CK tactic ID (e.g., 'TA0005') | |
| technique | No | MITRE ATT&CK technique ID (e.g., 'T1059') | |
| log_source | No | Log source type (e.g., 'AWS CloudTrail', 'Windows Event Log') | |
| max_results | No | ||
| threat_actor | No | Threat actor group name (e.g., 'APT29') |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| status | Yes | ||
| sources | Yes | ||
| metadata | No | ||
| patterns | Yes | ||
| warnings | Yes |