收集威胁情报→研究行为→创建Sigma、KQL和SPL草稿。

• 版本： 0.12.3。
• ** 通过：** Claude MCP、Python CLI 或本地仪表盘使用。
• SIEM 可选： 无需SIEM进行研究和本地测试。
• 当前状态： 支持的模式有效;但广泛的实际准确性尚未被验证。

检测到真实外部遥测信号（PowerShell 4103）

已验证本地信号匹配： 一个置顶的外部Mordor攻击仿真录音包含4,576个捕获的Windows事件，其中1,735条Windows PowerShell事件ID 4103条记录与记录的Host Application值中的编码命令交换机匹配。独立源代码被下载、哈希检查并实际通过GitHub行动运行#38994927672进行检查。查看证据报告、精确追踪和检测器。运行导出机器可读的检测报告。

含义： 这证明实现的 4103 专用 Python 可观测匹配器与真正的第三方 Windows 遥测数据匹配。这 1,735 条记录可能包含同一进程调用的重复日志，** 不代表 1,735 个不同攻击或独立标记为真阳性。

Intel2Detection-MCP

Collect threat intelligence → research behaviors → create Sigma, KQL and SPL drafts.

• Version: 0.12.3.
• Use through: Claude MCP, Python CLI or the local dashboard.
• SIEM optional: research and local testing work without one.
• Current status: supported patterns work; broad real-world accuracy is still unproven.

Real external telemetry signal detected (PowerShell 4103)

Verified local signal match: A pinned external Mordor attack-emulation recording contained 4,576 captured Windows events, of which 1,735 Windows PowerShell Event ID 4103 records matched an encoded-command switch in the logged Host Application value. The independent source was downloaded, hash-checked and actually inspected by GitHub Actions run #38994927672. See the evidence report and exact trace and the detector. The run exports a machine-readable detection report.

Meaning: This proves the implemented 4103-specific Python observable matcher matched genuine third-party Windows telemetry. The 1,735 records can include repeated logging of the same process invocation and do not represent 1,735 distinct attacks or independently labeled true positives. This does not test our different Sysmon Event ID 1 Sigma/KQL/SPL drafts in a native SIEM; no production detection accuracy is claimed.

Independently labeled event validation (strict, no invented results)

The optional scripts/evaluate_external_labels.py scores existing source-linked local draft rules only when an external event file and a separate independently evidenced label manifest are supplied. It rejects missing labels, mismatched source hashes, duplicates, and self-asserted synthetic provenance. If no stored rules are available, it returns UNSCORED, not a fabricated true negative.

& .\.venv\Scripts\python.exe scripts/evaluate_external_labels.py --events external-events.jsonl --labels independent-labels.json --rule-database path-to-research.sqlite3 --output external-evaluation.json

The labels JSON must contain schema_version: 1, provenance: "externally_verified_event_labels", external_dataset_url, independent_label_evidence_url, events_sha256 and an entry for each event with event_id, expected_malicious (boolean) and evidence (individual label explanation). Event records must already have event_id, timestamp and event_type, and must not embed assumed attack/benign labels. No synthetic examples are silently used as external ground truth.