detection-validation

Security Playbooks is a defensive security repository focused on MITRE ATT&CK mapping, detection engineering, incident response, threat hunting, detection rules (Sigma, YARA, and Suricata), security validation, and hands-on labs for cybersecurity professionals and SOC analysts.

Hands-on detection engineering portfolio focused on behavior-based threat detection, EQL, and real-world attack analysis

Benign, authorized-use-only adversary-emulation & detection-validation harness mapped to MITRE ATT&CK (purple-team; Caldera/Atomic Red Team category).

Redpen is a security testing harness that validates your defenses by simulating attacks with safe markers. It generates detailed reports, integrates with CI/CD, and maps to MITRE ATT&CK — so you know exactly what your security stack would catch in a real breach.

Risk-driven detection validation: runs real Atomic Red Team tests in an isolated Wazuh lab, proves whether your Sigma rules catch them with attributable evidence, and measures false positives — replay any run without the lab.

Safe local purple-team automation and ATT&CK detection validation framework

24 ATT&CK techniques replayed against a default Wazuh build: which fired, which did not, with rule IDs. 3 of 24 alerted. Every row carries its denominator.