<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Detection Gap Analysis

## DeTT&CT Framework

### Data Source Assessment

| Field | Description |
|---|---|
| `data_source_name` | Name matching ATT&CK data source |
| `date_registered` | When source was onboarded |
| `date_connected` | When source started flowing to SIEM |
| `products` | List of products providing this source |
| `available_for_data_analytics` | Boolean — usable for detection |
| `data_quality.completeness` | 1–5 score |
| `data_quality.timeliness` | 1–5 score |

### Visibility Layer

```yaml
platform: windows
techniques:
  - technique_id: T1003.001
    detection:
      - applicable_to: all
        score_logtype: process_access
        date_registered: 2026-01-15
        score: 4
        comment: "Sysmon EID 10 configured"
```

## Gap Categories

| Category | Telemetry | Rule | Validated | Action |
|---|---|---|---|---|
| Blind spot | ✗ | ✗ | ✗ | Enable log source |
| Silent gap | ✓ | ✗ | ✗ | Write Sigma rule |
| Weak detection | ✓ | ✓(low) | ✗ | Tune or rewrite rule |
| Unvalidated | ✓ | ✓ | ✗ | Run atomic test |
| Covered | ✓ | ✓ | ✓ | Maintain |

## Agent Script

```bash
# Inventory current rules
node agent.js inventory --rules-dir rules/ --output inventory.json

# Analyze gaps against threat actors
node agent.js analyze --inventory inventory.json --threat-actors APT29,FIN7 --output gaps.json

# Generate remediation plan
node agent.js remediation-plan --gaps gaps.json --max-rules 20 --output plan.json

# Update status after closing gaps
node agent.js update-status --gaps gaps.json --closed T1003.001,T1059.001
```
