detection-validation

Security Playbooks is a defensive security repository for detection engineers and SOC analysts, featuring MITRE ATT&CK mappings, incident response and threat hunting playbooks, detection rules (Sigma, YARA, and Suricata), security validation, coverage reporting, and hands-on labs.

Hands-on detection engineering portfolio focused on behavior-based threat detection, EQL, and real-world attack analysis

Ransomware behavior testing harness with synthetic record generation, directory encryption, recovery commands, and desktop alerts. Default mode avoids destructive recovery configuration changes but still encrypts files. Live mode can delete shadow copies and stop services. Restrict execution to disposable laboratories.

Risk-driven detection validation: runs real Atomic Red Team tests in an isolated Wazuh lab, proves whether your Sigma rules catch them with attributable evidence, and measures false positives — replay any run without the lab.

Safe local purple-team automation and ATT&CK detection validation framework

Structured purple team exercise: ATT&CK technique executed in an isolated lab, detection validated in Sentinel, gaps reported at CISO level.

Redpen is a security testing harness that validates your defenses by simulating attacks with safe markers. It generates detailed reports, integrates with CI/CD, and maps to MITRE ATT&CK — so you know exactly what your security stack would catch in a real breach.

Benign, authorized-use-only adversary-emulation & detection-validation harness mapped to MITRE ATT&CK (purple-team; Caldera/Atomic Red Team category).

24 ATT&CK techniques replayed against a default Wazuh build: which fired, which did not, with rule IDs. 3 of 24 alerted. Every row carries its denominator.