Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Analyzes detection coverage using Sigma, Splunk, and Elastic rules. Use when checking coverage for techniques, tactics, threat actors, or generating Navigator layers from detections.
.claude/skills/mhaggis-detection-coverage-analysis/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-11 | ✗→✓ | ▲ Improved | 116% | 0% |
| case-06 | ✓→✗ | ▼ Worse | 33% | 0% |
| case-10 | ✓→✓ | ＝ Same ✓ | 12% | 0% |
| case-20 | ✓→✓ | ＝ Same ✓ | 54% | 0% |
| case-21 | ✓→✓ | ＝ Same ✓ | 12% | 0% |
analyze_coverage(source_type: "elastic")Returns coverage % by tactic, top techniques, weak spots.
identify_gaps(threat_profile: "ransomware")
identify_gaps(threat_profile: "apt")
identify_gaps(threat_profile: "persistence")Returns prioritized P0/P1/P2 gaps with recommendations.
suggest_detections(technique_id: "T1059.001")Returns existing detections, data sources needed, detection ideas.
generate_navigator_layer(
name: "Elastic Initial Access",
source_type: "elastic",
tactic: "initial-access"
)Returns ready-to-import Navigator JSON.
get_technique_ids(source_type: "elastic", tactic: "persistence")Returns ~200 bytes instead of ~50KB.
| Profile | Key Techniques | |---------|----------------| | ransomware | T1486, T1490, T1027, T1547 | | apt | T1003, T1021, T1053, T1071 | | initial-access | T1566, T1190, T1078 | | persistence | T1547, T1543, T1053 | | credential-access | T1003., T1555, T1552 | | defense-evasion | T1027, T1070, T1055 |
# BAD - returns 200+ full detection objects
list_by_mitre_tactic(tactic: "execution")# GOOD - returns stats only
analyze_coverage(source_type: "elastic")| Old Approach | New Approach | |--------------|--------------| | list_by_mitre_tactic → ~50KB | analyze_coverage → ~2KB | | Parse in context | Done server-side | | 25x more tokens | Efficient |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 7,850 | 4,142 | -47% | 1 | 1 | 0% | 1,142 | 715 | -37% | 0 | 0 | — |
case-02 | fail→fail | 11,700 | 5,625 | -52% | 1 | 1 | 0% | 1,552 | 829 | -47% | 0 | 0 | — |
case-03 | fail→fail | 21,700 | 4,638 | -79% | 1 | 1 | 0% | 4,163 | 747 | -82% | 0 | 0 | — |
case-04 | fail→fail | 8,928 | 4,993 | -44% | 1 | 1 | 0% | 1,725 | 769 | -55% | 0 | 0 | — |
case-05 | fail→fail | 17,469 | 4,746 | -73% | 1 | 1 | 0% | 2,620 | 776 | -70% | 0 | 0 | — |
case-06 | pass→fail | 6,615 | 11,655 | +76% | 1 | 1 | 0% | 958 | 1,273 | +33% | 0 | 0 | — |
case-07 | fail→fail | 18,766 | 5,255 | -72% | 1 | 1 | 0% | 2,490 | 835 | -66% | 0 | 0 | — |
case-08 | fail→fail | 15,861 | 4,134 | -74% | 1 | 1 | 0% | 2,977 | 712 | -76% | 0 | 0 | — |
case-09 | fail→fail | 5,315 | 12,503 | +135% | 1 | 1 | 0% | 256 | 1,797 | +602% | 0 | 0 | — |
case-10 | pass→pass | 14,107 | 13,983 | -1% | 1 | 1 | 0% | 2,449 | 2,755 | +12% | 0 | 0 | — |
case-11 | fail→pass | 6,606 | 8,871 | +34% | 1 | 1 | 0% | 929 | 2,005 | +116% | 0 | 0 | — |
case-12 | fail→fail | 16,937 | 4,115 | -76% | 1 | 1 | 0% | 2,649 | 733 | -72% | 0 | 0 | — |
case-13 | fail→fail | 3,993 | 3,983 | -0% | 1 | 1 | 0% | 507 | 656 | +29% | 0 | 0 | — |
case-14 | fail→fail | 9,920 | 4,147 | -58% | 1 | 1 | 0% | 1,525 | 721 | -53% | 0 | 0 | — |
case-15 | fail→fail | 19,837 | 3,624 | -82% | 1 | 1 | 0% | 3,203 | 685 | -79% | 0 | 0 | — |
case-16 | fail→fail | 16,381 | 6,782 | -59% | 1 | 1 | 0% | 3,069 | 705 | -77% | 0 | 0 | — |
case-17 | fail→fail | 17,790 | 3,767 | -79% | 1 | 1 | 0% | 2,446 | 661 | -73% | 0 | 0 | — |
case-18 | fail→fail | 8,638 | 10,655 | +23% | 1 | 1 | 0% | 458 | 1,263 | +176% | 0 | 0 | — |
case-19 | fail→fail | 21,720 | 4,618 | -79% | 1 | 1 | 0% | 3,615 | 725 | -80% | 0 | 0 | — |
case-20 | pass→pass | 10,719 | 14,202 | +32% | 1 | 1 | 0% | 2,156 | 3,311 | +54% | 0 | 0 | — |
case-21 | pass→pass | 9,790 | 9,049 | -8% | 1 | 1 | 0% | 2,068 | 2,322 | +12% | 0 | 0 | — |
case-22 | pass→pass | 5,886 | 3,450 | -41% | 1 | 1 | 0% | 1,026 | 1,117 | +9% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 5 counted toward the lift figure. The other 17 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of 0 percentage points is the difference between those two pass rates over the 5 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.