---
name: mhaggis-detection-coverage-analysis
description: "Analyzes detection coverage using Sigma, Splunk, and Elastic rules. Use when checking coverage for techniques, tactics, threat actors, or generating Navigator layers from detections."
metadata:
  decimalai-skill-id: "0314a9d3-066d-4e01-8b20-a423600d46ed"
  decimalai-version-id: "58a57192-e7ca-4f59-8aaa-9135b4602b4f"
  decimalai-version: "1"
  decimalai-body-sha256: "255eed8679e85b6a788bf733ffbfc515e6797134fda7661f2854cd57c9f7ee57"
  decimalai-name: "mhaggis/detection-coverage-analysis"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "security"
  decimalai-source: "https://app.decimal.ai/s/mhaggis-detection-coverage-analysis@1/SKILL.md"
---
# Detection Coverage Analysis

## Efficient Tools (Use These!)

### Get Coverage Stats
```
analyze_coverage(source_type: "elastic")
```
Returns coverage % by tactic, top techniques, weak spots.

### Find Gaps by Threat Profile
```
identify_gaps(threat_profile: "ransomware")
identify_gaps(threat_profile: "apt")
identify_gaps(threat_profile: "persistence")
```
Returns prioritized P0/P1/P2 gaps with recommendations.

### Get Detection Suggestions
```
suggest_detections(technique_id: "T1059.001")
```
Returns existing detections, data sources needed, detection ideas.

### Generate Navigator Layer
```
generate_navigator_layer(
  name: "Elastic Initial Access",
  source_type: "elastic",
  tactic: "initial-access"
)
```
Returns ready-to-import Navigator JSON.

### Get Just Technique IDs
```
get_technique_ids(source_type: "elastic", tactic: "persistence")
```
Returns ~200 bytes instead of ~50KB.

## Threat Profiles Available

| Profile | Key Techniques |
|---------|----------------|
| ransomware | T1486, T1490, T1027, T1547 |
| apt | T1003, T1021, T1053, T1071 |
| initial-access | T1566, T1190, T1078 |
| persistence | T1547, T1543, T1053 |
| credential-access | T1003.*, T1555, T1552 |
| defense-evasion | T1027, T1070, T1055 |

## DON'T (burns tokens)
```
# BAD - returns 200+ full detection objects
list_by_mitre_tactic(tactic: "execution")
```

## DO (efficient)
```
# GOOD - returns stats only
analyze_coverage(source_type: "elastic")
```

## Token Comparison

| Old Approach | New Approach |
|--------------|--------------|
| list_by_mitre_tactic → ~50KB | analyze_coverage → ~2KB |
| Parse in context | Done server-side |
| 25x more tokens | Efficient |