Flow Coverage
get_flow_coverageMeasure how much of the corpus carries authored ATT&CK Flows, split by provenance, and summarize flow totals plus coverage gate to establish the denominator before interpreting flow-derived findings.
Instructions
How much of the corpus carries an authored ATT&CK Flow, split by provenance, plus flow node/transition/path-similarity totals and whether the flow similarity channel has met its coverage gate. Call this before reasoning over flow data so you know the denominator — flow-derived findings only speak to the covered slice.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| flows | Yes | ||
| channel | No | ||
| threats | Yes | ||
| authored | No | Flows with generator='harness'. Only these assert causality. | |
| flow_nodes | No | ||
| by_generator | No | ||
| coverage_pct | Yes | Authored flows as a percentage of the corpus — the denominator for any flow-derived claim. | |
| flow_transitions | No | ||
| path_similarity_pairs | No |