<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Mapping ATT&CK to Detection Coverage

## ATT&CK Navigator

### Layer API

| Field | Type | Description |
|---|---|---|
| `name` | string | Layer display name |
| `domain` | string | `enterprise-attack`, `mobile-attack`, `ics-attack` |
| `versions.attack` | string | ATT&CK version (e.g. `15.1`) |
| `techniques` | array | Technique objects with scores and metadata |
| `gradient` | object | Color gradient for score visualization |

### Technique Object

| Field | Type | Description |
|---|---|---|
| `techniqueID` | string | ATT&CK ID (e.g. `T1003.001`) |
| `tactic` | string | Tactic name (e.g. `credential-access`) |
| `score` | int | Coverage score 0–100 |
| `color` | string | Hex color override |
| `comment` | string | Free-text annotation |
| `metadata` | array | Key-value metadata pairs |
| `enabled` | bool | Show/hide technique in layer |

## mitreattack-python

### Core Methods

```python
from mitreattack.stix20 import MitreAttackData

attack = MitreAttackData("enterprise-attack.json")

# Get all techniques
techniques = attack.get_techniques()

# Get technique by ID
t = attack.get_object_by_attack_id("T1003.001", "attack-pattern")

# Get techniques used by group
group = attack.get_group_by_alias("APT29")
techs = attack.get_techniques_used_by_group(group)

# Get data sources for technique
sources = attack.get_data_sources()
```

## Agent Script

```bash
# Generate coverage layer
node agent.js generate-layer --rules-dir rules/ --output layer.json

# Generate with telemetry overlay
node agent.js generate-layer --rules-dir rules/ --telemetry-map telemetry.json --output layer.json

# Merge with threat actor layer
node agent.js merge-layers --coverage layer.json --threat-actor apt29.json --output gaps.json

# List gaps below threshold
node agent.js list-gaps --layer layer.json --min-score 0 --max-score 25
```
