analyze_coverage
Assess ATT&CK detection coverage by analyzing installed Sigma rules. Identifies weakly covered techniques with a sorted breakdown, or checks coverage for a specific technique ID.
Instructions
Analyze ATT&CK detection coverage across the installed Sigma rule set.
With no technique_id, returns an overall breakdown of how many rules cover each ATT&CK technique/tactic referenced anywhere in the rule set, sorted ascending by rule count so the weakest-covered techniques/tactics are easy to spot. With technique_id, returns a focused answer for just that one technique instead (rule_count 0 / covered=False if no installed rule references it -- not an error, a normal coverage answer).
IMPORTANT: coverage here means "referenced by tags on installed rules," not a gap analysis against the full MITRE ATT&CK matrix -- no MITRE reference dataset is bundled, so this cannot report techniques with zero rules across all of ATT&CK, only the distribution across what is actually installed. See coverage_scope in the result for this caveat.
Args: technique_id: Optional single ATT&CK technique ID (e.g. "T1059.001") to report focused coverage for instead of the full breakdown. rules_dir: Optional path to a rules directory. Defaults to the "rules" directory next to the resolved hayabusa binary. max_items: Maximum number of techniques/tactics to include in the overall breakdown lists (default 200). Ignored when technique_id is given.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| max_items | No | ||
| rules_dir | No | ||
| technique_id | No |