attack-coverage

Map your detection rules to MITRE ATT&CK and see where the gaps are. Given rules tagged with technique IDs, it computes coverage per tactic, lists undetected techniques, and flags technique IDs that are not in the reference map. Pure Python standard library, no dependencies.

Goal: turn "we have a lot of detections" into "here is exactly which tactics are thin and which techniques nobody covers."

What it does

• Reads detection rules as JSON ({id, name, techniques: ["T1059", ...]})
• Computes per-tactic coverage (covered / total) and an overall percentage
• Lists gaps (mapped techniques with no rule) per tactic
• Flags unknown technique IDs (typos or techniques missing from the map)
• Ships a compact bundled ATT&CK map; pass --attack-map to use your own

Files

• attack_coverage.py - CLI and coverage engine
• attack_map.json - compact bundled technique-to-tactic map
• sample-rules.json - example detection rule set
• test_attack_coverage.py - unit tests

Usage

python3 attack_coverage.py sample-rules.json
python3 attack_coverage.py sample-rules.json --json
python3 attack_coverage.py my-rules.json --attack-map full-attack.json

Test

python3 -m unittest -v

Disclaimer

This repository reflects personal study and practice. The bundled map is a compact subset for demonstration, not the full ATT&CK matrix - supply your own for real coverage analysis. MITRE ATT&CK is a trademark of The MITRE Corporation. Provided as-is.

License

MIT. See LICENSE.