analyze_coverage
Analyze detection coverage across MITRE ATT&CK tactics, identify weak spots below 50% of best tactic, and review top techniques, with optional source filtering.
Instructions
Get MITRE ATT&CK coverage stats: tactic breakdown, top 10 covered techniques, and weak-spot tactics (coverage < 50% of best tactic). Returns ~2KB. Filter by source_type to scope to a single rule source.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source_type | No | Filter by source: sigma, splunk_escu, elastic, kql |