art_coverage_report
Batch-validate detection coverage across MITRE techniques using Atomic Red Team tests. Identifies missing detection rules and returns a prioritized coverage matrix for threat actor validation or coverage audits.
Instructions
Batch validation of detection coverage across multiple MITRE techniques using Atomic Red Team tests. For each technique, checks if ART tests exist and if detection rules are present. Returns an overall coverage matrix, prioritized gaps, and per-technique status. Use for threat actor profile validation or coverage audits.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| technique_ids | Yes | Array of MITRE technique IDs to validate (e.g., ["T1059.001", "T1547.001", "T1505.003"]) |