Detection-as-Code

Folding conversion, deployment and validation into one ATT&CK Navigator layer with two status rules that keep it from lying, plus a Carbon console over the same files.

Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.

Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.

ATT&CK v18 split defense-evasion and renumbered techniques. Any coverage tool with the old IDs baked in now reports gaps that don’t exist. Here’s the fix.

IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.

Don’t assume what a SIEM’s REST API can do. Write a prober that asks the live instance, and let the answer shape the architecture.

Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.