// Public Surface

Open
Source

Code from the lab, and the bar a release has to clear.

Everything released is indexed below.

0x01Position

Claims are cheap in this field

Code and published research are the two artefacts a buyer can evaluate without taking anyone's word for it. They either work or they do not.

The other half of that surface is the research lab, where disclosures go up with their writeups and advisories.

0x02Index

Adversarial test harness for Sigma detection rules, assert a rule fires, then attack it with known evasions and report what slips past.

0x03Intent

Three categories, in the order they are likely to appear.

Released when an engagement or a research effort produced something reusable and no adequate public equivalent existed.

Where a harness verifies a disclosure faster than a paragraph, it ships with it.

Where a release makes an attack easier, it should also make the attack easier to see.

Hold the code above, the published research and the report structure against anyone else you are considering.

Elsewhere