PR Extension Workflow

To identify MITRE ATT&CK coverage gaps in a pull request, you can systematically scope new detection rules against missing sub-techniques, tactic coverage, and platform variants to recommend extensions before merging.

Detection coverage analysis is the process of evaluating pull requests to ensure new security detections are robust, well-documented, and aligned with threat intelligence and relevant analytic stories.

To check analytic story alignment, review the pull request to verify if new detections map to existing stories or if new stories must be created to maintain comprehensive threat intelligence context.

Yes, you can automate security detection quality review by applying a checklist that evaluates the correctness and quality of individual detection rules directly within your PR extension workflow.

To recommend additional detections for missing evasion techniques, analyze the pull request coverage gaps and generate concrete suggestions for supplementary detections, story updates, and test coverage.

No specific threat intelligence platforms are required as dependencies; the workflow operates directly on the pull request data to map detections against MITRE ATT&CK techniques and analytic stories.