detection-engineering-coverage-evaluation

Generate Threat Detection Opportunities from threat intelligence, create synthetic UDM events for each TDO, then call evaluate_rule_coverage_long_running per TDO. Poll get_operation until done is true for all operations, and inspect coverageResults for matched rules.

Call generate_rules only after all coverage evaluations complete and confirm zero matching rules for a TDO. Generating rules earlier risks creating duplicates for threats already covered by existing rules.

A Threat Detection Opportunity (TDO) is a structured representation of an attacker technique or threat derived from threat intelligence text. It is produced by generate_threat_detection_opportunity and drives synthetic event generation and coverage evaluation.

No. Newly generated rules are presented to the user first, and each rule requires explicit approval. Only approved rules are created in the SecOps environment via the create_rule tool.

Protobuf JSON serialization omits boolean fields set to false, so a missing alertingEnabled field means alerting is off. Treat absent alertingEnabled as false rather than inferring status from other fields.

Do not use it for threat hunting or SOC investigative actions, which fall outside its scope. It is designed specifically for evaluating and closing detection rule coverage gaps from threat intelligence sources.