Detkit
Sigma rules tested against attack telemetry, with precision, recall, and false-positive rates you can reproduce.
What gets checked
- Detection logic. A SQL evaluator runs rules against labelled attack events and benign look-alikes.
- Real telemetry. Hayabusa checks the Windows rules against pinned public EVTX captures.
- Quality gates. Each rule declares its minimum scores. A regression or unexplained lowered bar fails CI.
- Deployable queries. Rules compile to source-bound Splunk SPL, Microsoft XDR KQL, and Azure Monitor KQL where supported.
Run it
- Install uv, then clone the repository.
- Install the development dependencies and run the same sequence as CI.
git clone https://github.com/canmenzo/detkit.git
cd detkit
uv sync --all-extras
uv run detkit ciTo inspect individual stages:
uv run detkit eval
uv run detkit convert
uv run detkit dashboarddetkit ci downloads the pinned Hayabusa release and verifies its recorded SHA-256.
Coverage
What the tests don't prove
The benign cases are authored, so these scores do not predict alert volume in production. Entra ID rules use measured logic and schema validation, without replay against captured tenant telemetry. The repository documents these evidence limits alongside the results.