AgentSkillsCN

detection-coverage-analysis

利用 Sigma、Splunk 和 Elastic 规则分析检测覆盖率。适用于检查各类技术、战术、威胁行为者，或基于检测结果生成 Navigator 层时使用。

SKILL.md
--- frontmatter
name: detection-coverage-analysis  
description: Analyzes detection coverage using Sigma, Splunk, and Elastic rules. Use when checking coverage for techniques, tactics, threat actors, or generating Navigator layers from detections.

Detection Coverage Analysis

Efficient Tools (Use These!)

Get Coverage Stats

code
analyze_coverage(source_type: "elastic")

Returns coverage % by tactic, top techniques, weak spots.

Find Gaps by Threat Profile

code
identify_gaps(threat_profile: "ransomware")
identify_gaps(threat_profile: "apt")
identify_gaps(threat_profile: "persistence")

Returns prioritized P0/P1/P2 gaps with recommendations.

Get Detection Suggestions

code
suggest_detections(technique_id: "T1059.001")

Returns existing detections, data sources needed, detection ideas.

Generate Navigator Layer

code
generate_navigator_layer(
  name: "Elastic Initial Access",
  source_type: "elastic",
  tactic: "initial-access"
)

Returns ready-to-import Navigator JSON.

Get Just Technique IDs

code
get_technique_ids(source_type: "elastic", tactic: "persistence")

Returns ~200 bytes instead of ~50KB.

Threat Profiles Available

ProfileKey Techniques
ransomwareT1486, T1490, T1027, T1547
aptT1003, T1021, T1053, T1071
initial-accessT1566, T1190, T1078
persistenceT1547, T1543, T1053
credential-accessT1003.*, T1555, T1552
defense-evasionT1027, T1070, T1055

DON'T (burns tokens)

code
# BAD - returns 200+ full detection objects
list_by_mitre_tactic(tactic: "execution")

DO (efficient)

code
# GOOD - returns stats only
analyze_coverage(source_type: "elastic")

Token Comparison

Old ApproachNew Approach
list_by_mitre_tactic → ~50KBanalyze_coverage → ~2KB
Parse in contextDone server-side
25x more tokensEfficient