---
title: "Get MITRE ATT&CK matrix with detection coverage"
method: GET
path: "/api/mitre/matrix"
tags: ["MITRE Coverage"]
---

# Get MITRE ATT&CK matrix with detection coverage

`GET /api/mitre/matrix`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/mitre/matrix`
- Auth: HTTP bearer

Retrieve the MITRE ATT&CK framework matrix showing detection rule coverage as a heatmap

## Response `200`

Successful response

- object
  - `matrix` object, required: Complete MITRE ATT&CK matrix with detection coverage
    - `tactics` object[], required: Array of MITRE tactics
      - `tacticId` string, required: MITRE ATT&CK tactic ID (e.g., TA0001, TA0002)
      - `tacticName` string, required: Human readable tactic name
      - `description` string, required: Description of the tactic
      - `shortName` string, required: Short name used in kill chain phases
      - `techniqueIds` string[], required: Array of technique IDs in this tactic
      - `url` string: URL to official MITRE page
      - `detectionCount` number, required: Total number of detection rules for techniques in this tactic
      - `averageConfidence` number: Average confidence across all techniques
      - `rawData` object: Raw MITRE ATT&CK tactic data
        - `id` string, required
        - `type` 'x-mitre-tactic', required
        - `name` string, required
        - `description` string, required
        - `external_references` object[]
          - `source_name` string, required
          - `external_id` string
          - `url` string
          - `description` string
        - `x_mitre_shortname` string, required
        - `x_mitre_version` string
        - `x_mitre_attack_spec_version` string
        - `x_mitre_domains` string[]
        - `created` string, required
        - `modified` string, required
        - `spec_version` string
        - `object_marking_refs` string[]
    - `techniques` object[], required: Array of MITRE techniques
      - `techniqueId` string, required: MITRE ATT&CK technique ID (e.g., T1003, T1059.001)
      - `techniqueName` string, required: Human readable technique name
      - `description` string, required: Description of the technique
      - `tactics` string[], required: Array of tactic short names this technique belongs to
      - `isSubtechnique` boolean: Whether this is a subtechnique
      - `parentTechnique` string: Parent technique ID if this is a subtechnique
      - `platforms` string[]: Supported platforms
      - `dataSources` string[]: Data sources for detection
      - `mitigations` string[]: Related mitigation IDs
      - `url` string: URL to official MITRE page
      - `detectionCount` number, required: Number of detection rules mapped to this technique
      - `confidence` number, required: Average confidence score for this technique
      - `detectionRules` object[], required: Detection rules mapped to this technique
        - `id` string, required
        - `name` string, required
        - `source` 'panther' | 'sublime' | 'scanner' | 'datadog' | 'splunk' | 'sentinelone' | 'microsoftsentinel' | 'elastic' | 'sumologic' | 'runreveal' | 'cotool', required
        - `confidence` number, required
        - `reasoning` string, required
      - `rawData` object: Raw MITRE ATT&CK technique data
        - `id` string, required
        - `type` 'attack-pattern', required
        - `name` string, required
        - `description` string, required
        - `external_references` object[]
          - `source_name` string, required
          - `external_id` string
          - `url` string
          - `description` string
        - `kill_chain_phases` object[]
          - `kill_chain_name` string, required
          - `phase_name` string, required
        - `x_mitre_version` string
        - `x_mitre_attack_spec_version` string
        - `x_mitre_domains` string[]
        - `x_mitre_is_subtechnique` boolean
        - `x_mitre_detection` string
        - `x_mitre_platforms` string[]
        - `x_mitre_data_sources` string[]
        - `aliases` string[]
        - `created` string, required
        - `modified` string, required
        - `spec_version` string
        - `object_marking_refs` string[]
        - `revoked` boolean
        - `x_mitre_deprecated` boolean
    - `matrixCells` object[], required: Matrix cells for heatmap visualization
      - `techniqueId` string, required: MITRE ATT&CK technique ID
      - `techniqueName` string, required: Human readable technique name
      - `tacticId` string, required: MITRE ATT&CK tactic ID
      - `tacticName` string, required: Human readable tactic name
      - `detectionCount` number, required: Number of detection rules for this technique
      - `confidence` number, required: Average confidence score
      - `coverageLevel` 'none' | 'low' | 'medium' | 'high', required: Coverage level for heatmap coloring
    - `lastUpdated` string, required: When the matrix was last updated
    - `totalDetectionRules` number, required: Total number of detection rules processed
    - `organizationId` string, required: Organization ID this matrix belongs to
    - `attackVersion` string: MITRE ATT&CK Enterprise content version the matrix was built from (e.g. 19.2)

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)