coverage_compare
Compare two assessment sessions to reveal which MITRE techniques improved and how many detection gaps closed. Answer questions like 'How much does adding Sysmon improve coverage?'
Instructions
Compare coverage between two assessment sessions. Shows which techniques improved (GAP→PARTIAL→DETECTABLE→COVERED) and how many gaps were closed. Use to answer: "If I add Sysmon, how much does my coverage improve?"
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| session_after | Yes | Session ID of the comparison (after adding new log sources) | |
| session_before | Yes | Session ID of the baseline (before) |