art_validate_technique
Cross-reference Atomic Red Team tests with your detection rules for any MITRE technique to reveal uncovered gaps. Get a per-test COVERED/GAP validation matrix and overall coverage percentage to find blind spots in supposedly complete rules.
Instructions
Cross-reference Atomic Red Team tests against existing detection rules for a MITRE technique. For each ART test, checks whether any detection rule in the repo matches the attack artifacts. Returns a per-test validation matrix with COVERED/GAP status and an overall coverage percentage. Use this to find blind spots in rules you thought were complete.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| technique_id | Yes | MITRE technique ID (e.g., "T1059.001") |