analyze_detection_effectiveness
Evaluate detection rules against LOL techniques to measure coverage, estimate false positives, assess bypass risk, and score rule quality.
Instructions
Analyze detection rule effectiveness — rule vs technique coverage, false positive estimation, bypass probability, overall rule quality scoring.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Effectiveness analysis mode | |
| binary | No | Binary name | |
| rule_name | No | Detection rule name or ID to analyze | |
| technique_id | No | LOL technique ID |