coverage_gaps_detail
Identify coverage gaps in detection sessions by viewing missing data sources and remediation steps for each GAP or PARTIAL technique. Filter by MITRE tactic and coverage status.
Instructions
Get detailed gap report for a coverage session. Shows every technique that is GAP or PARTIAL, with exactly which data sources are missing and remediation steps. Filterable by tactic and coverage status.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results to return (default: 50) | |
| session_id | Yes | Session ID (must have run coverage_assess_session first) | |
| status_filter | No | Filter by coverage status: GAP, PARTIAL, DETECTABLE, COVERED, or omit for all non-COVERED | |
| tactic_filter | No | Filter by MITRE tactic (e.g., "execution", "persistence", "credential-access") |