docs: bring README up to date with the 24-technique catalog - #7
Merged
Conversation
…e catalog The README technique table still listed only REP-001..REP-011, all marked Implemented, while main carries 24. That table is the first thing a visitor reads, so it would have undercounted the tool by thirteen techniques on the public flip. - Adds REP-012..REP-024 to the table, cross-checked programmatically against data/technique-catalog.yaml: no missing ids, no extra ids, no ndr_uc mismatches. - Explains the two conventions the expansion established, since neither is visible from the table alone: several entries are the deliberately harder counterpart of an earlier one (REP-001/REP-012, REP-004/REP-015, REP-002/REP-019), and techniques whose detection depends on separating a signal from a look-alike now emit the look-alike too. - Points at the two research docs for the anchors, the evidence, and the ideas considered and rejected. - Roadmap gains the catalog expansion and the tactic-grouping next step. Also corrects "seven golden sample lines" to eight in README, CLAUDE.md, and the Palo Alto and Check Point reference docs, since each reference gained a dns-response line. The docs/images/cli-list.png screenshot still shows the eleven-technique menu. Its alt text no longer claims a count, but the image itself is stale and needs regenerating. Historical phase documents (phase1-kickoff-prompt, phase4-scenario- composition-design) still say eleven on purpose: they describe what those phases delivered at the time.
404SecNotFound
added a commit
that referenced
this pull request
Sep 1, 2026
…map #7) (#94) * feat: per-run analyst validation card for single-technique runs (roadmap #7) After an ad-hoc 'replicant run', the analyst otherwise reverse-engineers the pivot entities, window, and expected rule from a raw JSON manifest, the manual toil the tool sells against. run() now writes a copy-pasteable card beside the manifest (<stem>.card.md) and RunResult.summary() names it. The card is deterministic, derived from the plan's own events, and authors no rule logic (blueprint boundary): its search is a hunt pivot that LOCATES the run's events, not a detection rule. - Ties to #3: a marked run's find-events search keys on flexString1=<run_id>, so the exact events are one search away; an unmarked (loopback/--to-file/--no-send) run pivots on the top src/dst and the emitted window instead. - Ties to #5: the card carries the transferability verdict and note, so it states what a green result does and does not prove, plus the loopback-only delivery caveat. - Names objective, ndr_rule/ndr_uc, held/varied CEF fields, pivot entities, and the emitted window (real under --pace plan). Positive control: dropped the write_validation_card call and the four behavioural card tests went red, restored them green. 1079 tests; gates clean. * review: card follows the compressed wire, survives a write failure, reuses DUBAI_TZ From /code-review on PR #94, verified before fixing: 1. (main) The card's window and count came from the uncompressed plan.events, so a --speed run's card claimed the raw timeline as 'real'. run() now builds the card from compress_timeline(plan.events, speed)[:count] - what actually went out - fixing both the --speed window and the overstated count on a graceful stop. New test exercises --speed (via --no-send so it does not wait the plan timeline); positive control observed red against plan.events, green. 2. The card build/write was outside the try/except, so a card-write OSError could fail a send that had already completed. Now wrapped: a secondary artifact logs a warning and leaves card_path None instead of raising. 3. Unmarked pivot query no longer leads with a dangling 'and' when a technique carries no src/dst (joined, not concatenated). 4. Reuse: the card imports DUBAI_TZ from audit.manifest instead of a fifth hard-coded timezone(timedelta(hours=4)). 1080 tests; black/ruff/mypy clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the v0.2.0 merges. Docs only, no code.
The problem this fixes
The README technique table still listed only REP-001..REP-011, all marked Implemented, while
maincarries 24. That table is the first thing a visitor reads, so on the public flip the README would have undercounted the tool by thirteen techniques.Changes
data/technique-catalog.yaml: no missing ids, no extra ids, nondr_ucmismatches.dns-responseline.Known stale, not fixed here
docs/images/cli-list.pngstill shows the eleven-technique menu. Its alt text no longer claims a count, but the image itself needs regenerating and a screenshot is not something I can reliably reproduce headless. Flagging rather than silently leaving it.The historical phase documents (
phase1-kickoff-prompt.md,phase4-scenario-composition-design.md) still say eleven on purpose: they describe what those phases delivered at the time, and rewriting them would falsify the record.Verification
438 tests pass. Docs-only diff, so no behavior change.