coverage_recommend
Analyze coverage gaps and rank missing log sources by how many technique gaps they would close, weighted by actor usage, for prioritized detection improvements.
Instructions
Pareto-optimal log source recommendations. Analyzes coverage gaps and ranks missing data sources by how many technique gaps they would close. Answers: "Enable these 5 log sources to close 80% of your gaps." Prioritizes by actor usage (techniques used by more actors = higher priority).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | Session ID (must have run coverage_assess_session first) | |
| max_recommendations | No | Maximum recommendations to return (default: 10) |