Hi, I'm B. Mensah - building testable detection-engineering labs

[bsmensah-ctrl]

Hi everyone - I'm B. Mensah, a student interested in detection engineering and the gap between writing a rule and proving its correlation logic behaves under positive, incomplete, reordered, and noisy event streams. I'm here to learn from maintainers, contribute to open source, and share what survives real review.

I'm working with Python, SARIF, deterministic security telemetry, and regression testing. My current project, DLL Injection Lab, models a five-signal process-injection detection chain using synthetic events only - no live-process access or DLL injection. It now has 35 tests and a client-side browser demo.

My next step is to add more realistic negative controls, keep taking outside review seriously, and contribute useful improvements to other security projects.

How do other detection-tool maintainers decide which near-miss controls belong beside a positive fixture?

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.