---
name: pentest-guide
description: Review supplied HTTP response evidence and ATT&CK detection coverage with pentest_* tools. Use when distinguishing pattern findings from confirmed exposure, checking a group or software identity, or interpreting profile-ranked techniques without overstating coverage.
license: Apache-2.0
metadata:
  author: "cyanheads"
  version: "1.0"
---

## Scope

Use for evidence review and defensive coverage assessment during authorized work. ATT&CK records come from an embedded Enterprise dataset; Mobile and ICS matrices are outside its coverage.

## Gates

- Treat response findings and fingerprints as hypotheses to reconcile with the supplied evidence. A matched pattern does not establish exploitability; no findings does not establish safety.
- Before concluding that a security header is absent, establish that the supplied headers are complete for that response. Body-only analysis cannot establish header presence or absence. Keep conclusions about partial input limited to the excerpt supplied.
- Before using a name or keyword lookup in a coverage report, verify the returned ATT&CK identity against the intended group, software, or technique. A best match is not an identity confirmation.
- Keep ATT&CK conclusions scoped to the returned dataset version and Enterprise matrix. A missing record or association does not prove that a behavior never occurs.
- Use profile relevance and its rationale to prioritize review. Do not present the score as a vulnerability finding, likelihood, or probability. If the response reports truncation, do not call the returned set exhaustive.

## Workflows

### Review an existing HTTP response

Analyze the available authorized response with `pentest_analyze_response`. Separate what the response explicitly contains from what the pattern matcher infers. For each reported issue, retain the supporting observation, the interpretation, and any evidence still needed before confirming impact.

When a finding suggests a methodology vector, consult `pentest_get_guide` for relevant detection and mitigation context. Treat suggested follow-ups as leads; they do not establish that the corresponding weakness exists. When reporting no findings, state which response material was analyzed and that no matching patterns were found.

### Review ATT&CK detection coverage

Start from the known group or software when the question concerns reported behavior; start from the known target profile when the question concerns review priorities. After verifying the returned identity, inspect selected techniques with `pentest_lookup_technique` for detection and mitigation context.

Compare that context with the defensive evidence actually available. Report documented behavior, observed evidence, and unverified coverage separately. Preserve the ATT&CK dataset version in the assessment, and describe a returned association list or ranked shortlist as the reviewed set rather than a complete inventory.