I wanted Hekili to suggest using Mirror Image when my frost mage picked up threat, but couldn't find a condition to support that rule. So I added to State.lua a new line after 5639 (state.tanking):

5639 state.tanking = state.role.tank and ( UnitThreatSituation( "player" ) or 0 ) > 1
new state.has_agro = ( UnitThreatSituation( "player" ) or 0 ) > 1

This may be a naive implementation, but it does appear to work for me. (I use it conjunction with a new action for Mirror Image, condition=has_agro & group & fight_remains > 6).

The action/condition feels maybe up to individual player taste, but I thought I'd file this suggestion for just exposing the has_agro condition which might be generally helpful across many specs/players?

I'll be adding aggro in the next release.