---

name: detection-coverage-analysis
description: Analyzes detection coverage using Sigma, Splunk, and Elastic rules. Use when checking coverage for techniques, tactics, threat actors, or generating Navigator layers from detections.

Detection Coverage Analysis

Efficient Tools (Use These!)

Get Coverage Stats

Copyanalyze_coverage(source_type: "elastic")

Returns coverage % by tactic, top techniques, weak spots.

Find Gaps by Threat Profile

Copyidentify_gaps(threat_profile: "ransomware")
identify_gaps(threat_profile: "apt")
identify_gaps(threat_profile: "persistence")

Returns prioritized P0/P1/P2 gaps with recommendations.

Get Detection Suggestions

Copysuggest_detections(technique_id: "T1059.001")

Returns existing detections, data sources needed, detection ideas.

Generate Navigator Layer

Copygenerate_navigator_layer(
  name: "Elastic Initial Access",
  source_type: "elastic",
  tactic: "initial-access"
)

Returns ready-to-import Navigator JSON.

Get Just Technique IDs

Copyget_technique_ids(source_type: "elastic", tactic: "persistence")

Returns ~200 bytes instead of ~50KB.

Threat Profiles Available

DON'T (burns tokens)

Copy# BAD - returns 200+ full detection objects
list_by_mitre_tactic(tactic: "execution")

DO (efficient)

Copy# GOOD - returns stats only
analyze_coverage(source_type: "elastic")

Token Comparison