Skip to content

v1.1.0 — Real Detection Evaluation

Choose a tag to compare

View all tags
@jayelbotvibe-web jayelbotvibe-web released this 04 Jul 17:34
v1.1.0
be1459c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.1.0 — Real Sigma Rule Matching

The correctness release. v1.0 reported 100% detection because the evaluator used presence logic
(any events = DETECTED). v1.1 replaced it with a native Go Sigma parser and matcher — real rules,
real evaluation.

What changed

v1.0 (presence) v1.1 (real)
Evaluator any events → DETECTED Sigma rule must match
Coverage 100% (inflated) honest (gap documented)
Verdicts 3 states 5 states (DETECTED, PARTIAL, MISSED, NO_TELEMETRY, ERROR)
CI regression fixture JSON validity only positives MUST match, negatives MUST reject

Verdict semantics

  • DETECTED: Sigma rule condition matched an event
  • MISSED: Events collected, no rule matched — real detection gap
  • NO_TELEMETRY: Zero events in window — collection problem, not detection
  • ERROR: Rule parse/evaluator failure

Components

  • Native Go Sigma rule parser (detection block, field modifiers, condition grammar)
  • Event normalizer (Wazuh JSON → canonical fields: Image, ParentImage, CommandLine, User)
  • 5-state evaluator replacing presence-based logic
  • Enforced CI regression test (10 rules, 20 fixtures)

Known gap

Live lab: Linux telemetry sources (command output, SCA) lack Sysmon process-creation fields.
Windows Sysmon Event ID 1 needed for real detection evaluation — addressed in v1.2.

Assets 2
Loading