<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing MITRE ATT&CK Evaluations

## Detection Categories

| Category | Score | Criteria |
|---|---|---|
| None | 0 | No telemetry or detection observed |
| Telemetry | 1 | Minimally processed data (raw events available) |
| General | 2 | Alert/enrichment without ATT&CK mapping |
| Tactic | 3 | Detection identifies ATT&CK tactic correctly |
| Technique | 4 | Detection identifies specific ATT&CK technique |

## Protection Categories

| Category | Description |
|---|---|
| None | Attack completed without interference |
| Blocked | Attack prevented before achieving objective |
| Delayed | Attack partially executed before prevention |

## Evaluation Phases

| Phase | Typical Techniques |
|---|---|
| Initial Access | T1566.001, T1566.002, T1190 |
| Execution | T1059.001, T1059.003, T1204.002 |
| Persistence | T1053.005, T1547.001, T1136.001 |
| Credential Access | T1003.001, T1003.003, T1558.003 |
| Lateral Movement | T1021.002, T1021.001, T1021.006 |
| Collection | T1005, T1074.001, T1560.001 |
| Exfiltration | T1041, T1048.003, T1567.002 |

## Agent Script

```bash
# Create evaluation plan
node agent.js create-plan --threat-actor APT29 \
  --phases initial-access,execution,credential-access --output plan.json

# Execute step
node agent.js execute-step --plan plan.json --step 1 \
  --technique T1566.001 --description "Spearphishing attachment"

# Record result
node agent.js record-result --plan plan.json --step 1 \
  --detection-category technique --protection none \
  --product "CrowdStrike Falcon" --evidence "Alert fired"

# Score product
node agent.js score-product --plan plan.json --product "CrowdStrike Falcon"

# Compare products
node agent.js compare --plans plan-cs.json,plan-s1.json --output comparison.json

# Export Navigator layer
node agent.js export-layer --plan plan.json --product "CrowdStrike Falcon" --output layer.json
```
