Technique Co-occurrence Rules
get_technique_rulesDiscover MITRE ATT&CK techniques that co-occur in threats, backed by lift with support and confidence. Reveals which techniques appear together to uncover attack correlation patterns.
Instructions
MITRE ATT&CK technique PAIRS mined from the corpus with support, confidence and lift — which techniques travel together far above chance. Each rule carries both technique ids AND their ATT&CK names (technique_a_name / technique_b_name), so a rule is readable without a follow-up lookup. Complements predict_mitre_transitions exactly: that answers sequence (what follows what), this answers co-occurrence (what appears alongside what). Rules come back lift-descending; summary.total_rules reports how many exist in total, so has_more tells you whether the tail was cut. Note minSupport 0.02 — a pair must appear in ~2% of threats to be mined at all, so rare-technique pairs are structurally absent rather than uncorrelated.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Default 50, max 100. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| rules | Yes | ||
| summary | No |