Skip to content

v0.1.2 — Rebuilt backtest corpus

Latest

Choose a tag to compare

@jamesbower jamesbower released this 09 Sep 17:04
· 4 commits to main since this release

Rebuilds the backtest corpus. Includes everything in 0.1.1 (JSON Lines parsing + the loader hotfix), so this can go out on its own.

pip install -U detect-forge

Added

  • Rebuilt Mordor corpus from the current OTRF Security-Datasets: 55 techniques / 73 atomic Windows host datasets (previously only 2 were still live), each with a real SHA256, size, and event count (~523k events total). Restores meaningful adversarial-replay coverage.
  • Index structure-guard test — bad technique IDs, missing SHA256, or non-https URLs now fail CI, so corpus drift is caught early.

Verified end-to-end: a T1003.001 rule downloads → SHA-verifies → JSONL-parses → fires on both mapped datasets.

Full diff: v0.1.1...v0.1.2