Taha

No, this is not a reference to a failed love story. Come and learn what containers are.

Folding conversion, deployment and validation into one ATT&CK Navigator layer with two status rules that keep it from lying, plus a Carbon console over the same files.

Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.

Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.

ATT&CK v18 split defense-evasion and renumbered techniques. Any coverage tool with the old IDs baked in now reports gaps that don’t exist. Here’s the fix.

IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.