v0.1.2 — Rebuilt backtest corpus

Rebuilds the backtest corpus. Includes everything in 0.1.1 (JSON Lines parsing + the loader hotfix), so this can go out on its own.

pip install -U detect-forge

Added

• Rebuilt Mordor corpus from the current OTRF Security-Datasets: 55 techniques / 73 atomic Windows host datasets (previously only 2 were still live), each with a real SHA256, size, and event count (~523k events total). Restores meaningful adversarial-replay coverage.
• Index structure-guard test — bad technique IDs, missing SHA256, or non-https URLs now fail CI, so corpus drift is caught early.

Verified end-to-end: a T1003.001 rule downloads → SHA-verifies → JSONL-parses → fires on both mapped datasets.

Full diff: v0.1.1...v0.1.2

v0.1.1 — Backtest corpus hotfix

Backtest hotfix. The bundled corpus was unusable against the live Security-Datasets repo; backtest/audit silently reported every rule as untested. Upgrade recommended.

pip install -U detect-forge

Fixed

• JSON Lines datasets — backtest now parses the real Security-Datasets on-disk format (one event per line). The loader previously assumed a JSON array and failed every real dataset with "Extra data", reporting all rules untested.
• Pruned + hashed Mordor index — 14 of 16 bundled dataset URLs had 404'd upstream; the index now lists only the datasets that are live, with real SHA256 hashes, so integrity is verified and runs no longer emit 404 warnings.

Verified end-to-end against live Security-Datasets: a rule now downloads → SHA-verifies → JSONL-parses → matches → fires.

Full diff: v0.1.0...v0.1.1

v0.1.0 — Initial public release

Initial public release of Detect-Forge — an AI-native detection-engineering toolkit. One install, one config, one CI step.

Install

pip install detect-forge

Highlights

• stale — score Sigma/Elastic rules for ATT&CK technique staleness (timestamp drift, semantic drift, opt-in LLM diff proposals).
• coverage — map rules to the ATT&CK matrix (full/shallow/gap) with CTID-weighted priority gating and Navigator export.
• backtest — adversarial replay against the bundled Mordor corpus with Sigma + Elastic (EQL/KQL) matchers and two CI gates.
• audit — one-step composite gate over stale + coverage + backtest.
• Ships as a PEP 561 typed package; runs as a GitHub Actions CI gate. No data leaves your environment.

See the CHANGELOG for the full list, including the correctness and security hardening in this release.

Full metadata: https://github.com/jamesbower/Detect-Forge/blob/v0.1.0/README.md