detection-coverage-analysis
Evaluates security detection coverage across various rule sets.
Install
mkdir -p .claude/skills/detection-coverage-analysis && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12469" && unzip -o skill.zip -d .claude/skills/detection-coverage-analysis && rm skill.zipInstalls to .claude/skills/detection-coverage-analysis
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Analyzes detection coverage using Sigma, Splunk, and Elastic rules. Use when checking coverage for techniques, tactics, threat actors, or generating Navigator layers from detections.Key capabilities
- →Get detection coverage statistics by tactic
- →Identify detection gaps by threat profile
- →Get detection suggestions for specific techniques
- →Generate MITRE Navigator layers from detections
- →Retrieve technique IDs for specific source types and tactics
How it works
The skill provides efficient tools to analyze detection coverage using Sigma, Splunk, and Elastic rules. It offers functions to get stats, identify gaps, suggest detections, and generate Navigator layers.
Inputs & outputs
When to use detection-coverage-analysis
- →Analyze security coverage
- →Identify detection gaps
- →Generate MITRE Navigator layer
About this skill
Detection Coverage Analysis
Efficient Tools (Use These!)
Get Coverage Stats
analyze_coverage(source_type: "elastic")
Returns coverage % by tactic, top techniques, weak spots.
Find Gaps by Threat Profile
identify_gaps(threat_profile: "ransomware")
identify_gaps(threat_profile: "apt")
identify_gaps(threat_profile: "persistence")
Returns prioritized P0/P1/P2 gaps with recommendations.
Get Detection Suggestions
suggest_detections(technique_id: "T1059.001")
Returns existing detections, data sources needed, detection ideas.
Generate Navigator Layer
generate_navigator_layer(
name: "Elastic Initial Access",
source_type: "elastic",
tactic: "initial-access"
)
Returns ready-to-import Navigator JSON.
Get Just Technique IDs
get_technique_ids(source_type: "elastic", tactic: "persistence")
Returns ~200 bytes instead of ~50KB.
Threat Profiles Available
| Profile | Key Techniques |
|---|---|
| ransomware | T1486, T1490, T1027, T1547 |
| apt | T1003, T1021, T1053, T1071 |
| initial-access | T1566, T1190, T1078 |
| persistence | T1547, T1543, T1053 |
| credential-access | T1003.*, T1555, T1552 |
| defense-evasion | T1027, T1070, T1055 |
DON'T (burns tokens)
# BAD - returns 200+ full detection objects
list_by_mitre_tactic(tactic: "execution")
DO (efficient)
# GOOD - returns stats only
analyze_coverage(source_type: "elastic")
Token Comparison
| Old Approach | New Approach |
|---|---|
| list_by_mitre_tactic → ~50KB | analyze_coverage → ~2KB |
| Parse in context | Done server-side |
| 25x more tokens | Efficient |
When not to use it
- →When needing full detection objects for every technique
- →When needing to parse detection data in context
Limitations
- →Threat profiles are predefined
- →Does not return full detection objects when using `analyze_coverage`
- →Relies on specific `analyze_coverage`, `identify_gaps`, `suggest_detections`, `generate_navigator_layer`, and `get_technique_ids` functions
How it compares
This skill provides specialized, efficient functions for detection coverage analysis, focusing on statistical summaries and targeted suggestions, unlike retrieving large, full detection objects.
Compared to similar skills
detection-coverage-analysis side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| detection-coverage-analysis (this skill) | 0 | 7mo | No flags | Intermediate |
| pcap-analysis | 7 | 6mo | Review | Intermediate |
| burpsuite-project-parser | 1 | 2mo | Review | Advanced |
| wireshark-network-traffic-analysis | 1 | 6mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
pcap-analysis
benchflow-ai
Guidance for analyzing network packet captures (PCAP files) and computing network statistics using Python, with tested utility functions.
burpsuite-project-parser
trailofbits
Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.
wireshark-network-traffic-analysis
davila7
This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
hunt-analytics-generation
OTRF
Generate query-agnostic analytics that model adversary behavior by translating hunt investigative intent into analytic definitions grounded in schema semantics. This skill is used to define how behavior should manifest in data before query execution or validation, and works best when informed by system internals, adversary tradecraft, a structured hunt focus, and suggested data sources.
logicmso
BrownFineSecurity
Analyze digital and analog captures from Saleae Logic MSO devices. Decode protocols like UART, SPI, I2C from exported binary files. Use when analyzing logic analyzer captures for CTF challenges, hardware reverse engineering, or protocol decoding.
groq-data-handling
jeremylongshore
Implement Groq PII handling, data retention, and GDPR/CCPA compliance patterns. Use when handling sensitive data, implementing data redaction, configuring retention policies, or ensuring compliance with privacy regulations for Groq integrations. Trigger with phrases like "groq data", "groq PII", "groq GDPR", "groq data retention", "groq privacy", "groq CCPA".