Intel2Detection-MCP

Collect threat intelligence → research behaviors → create Sigma, KQL and SPL drafts.

• Version: 0.12.3.
• Use through: Claude MCP, Python CLI or the local dashboard.
• SIEM optional: research and local testing work without one.
• Current status: supported patterns work; broad real-world accuracy is still unproven.

Real external telemetry signal detected (PowerShell 4103)

Verified local signal match: A pinned external Mordor attack-emulation recording contained 4,576 captured Windows events, of which 1,735 Windows PowerShell Event ID 4103 records matched an encoded-command switch in the logged Host Application value. The independent source was downloaded, hash-checked and actually inspected by GitHub Actions run #38994927672. See the evidence report and exact trace and the detector. The run exports a machine-readable detection report.

Meaning: This proves the implemented 4103-specific Python observable matcher matched genuine third-party Windows telemetry. The 1,735 records can include repeated logging of the same process invocation and do not represent 1,735 distinct attacks or independently labeled true positives. This does not test our different Sysmon Event ID 1 Sigma/KQL/SPL drafts in a native SIEM; no production detection accuracy is claimed.

Independently labeled event validation (strict, no invented results)

The optional scripts/evaluate_external_labels.py scores existing source-linked local draft rules only when an external event file and a separate independently evidenced label manifest are supplied. It rejects missing labels, mismatched source hashes, duplicates, and self-asserted synthetic provenance. If no stored rules are available, it returns UNSCORED, not a fabricated true negative.

& .\.venv\Scripts\python.exe scripts/evaluate_external_labels.py --events external-events.jsonl --labels independent-labels.json --rule-database path-to-research.sqlite3 --output external-evaluation.json

The labels JSON must contain schema_version: 1, provenance: "externally_verified_event_labels", external_dataset_url, independent_label_evidence_url, events_sha256 and an entry for each event with event_id, expected_malicious (boolean) and evidence (individual label explanation). Event records must already have event_id, timestamp and event_type, and must not embed assumed attack/benign labels. No synthetic examples are silently used as external ground truth.