get_top_gaps
Identify the top 5 uncovered or least-covered ATT&CK technique IDs for a threat profile, returning only IDs for fast triage before detailed gap analysis.
Instructions
Get the top 5 uncovered (or least-covered) technique IDs for a threat profile (~300 bytes). Returns only IDs — use as a fast triage signal before calling identify_gaps for full detail.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| threat_profile | Yes | Threat profile: ransomware, apt, initial-access, persistence, credential-access, defense-evasion |