Mitre-Attack

Folding conversion, deployment and validation into one ATT&CK Navigator layer with two status rules that keep it from lying, plus a Carbon console over the same files.

Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.

ATT&CK v18 split defense-evasion and renumbered techniques. Any coverage tool with the old IDs baked in now reports gaps that don’t exist. Here’s the fix.

IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.

Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.