detect-forge 0.1.0__tar.gz

detect_forge-0.1.0/.detect-forge.toml

@@ -0,0 +1,19 @@
+[stale]
+semantic_threshold = 0.65
+llm_model = "gpt-4o-mini"
+max_proposals = 5
+
+[coverage]
+priority_list = ""              # path to custom JSON; empty = built-in CTID default
+gate_on_priority_gaps = true    # exit 2 when priority techniques have no rules
+
+[backtest]
+gate_on_priority_silence = true   # exit 2 when priority technique is silent
+gate_on_broken_rules = true       # exit 2 when any rule is silent on all tested datasets
+mordor_source = ""                # local Security-Datasets checkout; empty = fetch
+platform = "all"                  # windows | linux | macos | all
+
+[audit]
+gate_strategy = "all"             # "all" | "never". Default "all" (strict-AND).
+subcommands = ["stale", "coverage", "backtest"]   # subset to run
+include_llm_proposals = false     # cost gate; default off

detect_forge-0.1.0/.env.sample

@@ -0,0 +1,27 @@
+# Copy this file to `.env` and fill in values. `.env` is gitignored.
+
+# ---- LLM Diff Proposals (Phase 4) ----
+# Required for LLM diff proposals on semantically drifted rules.
+# When unset, scans complete normally with a skip banner.
+OPENAI_API_KEY=
+
+# ---- detect-forge Settings (DETECT_FORGE_* env-prefix) ----
+# All optional; values override the built-in defaults.
+
+# Cache directory for ATT&CK STIX bundles and embeddings.
+# Default: $XDG_CACHE_HOME/detect-forge (or ~/.cache/detect-forge).
+# DETECT_FORGE_CACHE_DIR=/path/to/cache
+
+# How long the ATT&CK STIX bundle stays fresh before re-fetch.
+# DETECT_FORGE_CACHE_TTL_HOURS=24
+
+# Which ATT&CK domain to score against.
+# Options: enterprise-attack, mobile-attack, ics-attack
+# DETECT_FORGE_ATTACK_DOMAIN=enterprise-attack
+
+# Disable cache entirely (re-fetch and re-embed on every run).
+# DETECT_FORGE_NO_CACHE=false
+
+# Override the semantic_threshold from .detect-forge.toml without editing
+# the file. Takes precedence over CLI flag and config file.
+# DETECT_FORGE_SEMANTIC_THRESHOLD=0.65

detect_forge-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: lint + type-check + tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install (with dev extras)
+        run: python -m pip install -e ".[dev]"
+
+      - name: Ruff
+        run: ruff check src/ tests/
+
+      - name: Mypy (strict)
+        run: mypy src/
+
+      - name: Pytest
+        run: pytest -q
+
+  build:
+    name: build + twine check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: python -m pip install build twine
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Twine check
+        run: python -m twine check dist/*

detect_forge-0.1.0/.github/workflows/python-publish.yml

@@ -0,0 +1,77 @@
+# This workflow will upload a Python Package to PyPI when a release is created
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Upload Python Package
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  release-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install project + build tooling
+        run: python -m pip install -e ".[dev]" build
+
+      - name: Verify tag matches package version
+        run: |
+          PKG=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          TAG="${GITHUB_REF_NAME#v}"
+          test "$PKG" = "$TAG" || { echo "::error::release tag '$TAG' != package version '$PKG'"; exit 1; }
+
+      - name: Test
+        run: pytest -q
+
+      - name: Build release distributions
+        run: python -m build
+
+      - name: Twine check
+        run: python -m twine check dist/*
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-dists
+          path: dist/
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs:
+      - release-build
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+
+    # Dedicated environments with protections for publishing are strongly recommended.
+    # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules
+    environment:
+      name: pypi
+      url: https://pypi.org/p/detect-forge
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v8
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

detect_forge-0.1.0/.gitignore

@@ -0,0 +1,20 @@
+__pycache__/
+*.py[cod]
+*$py.class
+.Python
+build/
+dist/
+*.egg-info/
+.eggs/
+.venv/
+venv/
+.env
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.DS_Store
+data/
+/docs/superpowers/
+.claude/

detect_forge-0.1.0/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to Detect-Forge are documented here. The format is based
+on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-09
+
+Initial public release.
+
+### Added
+- `stale` — score Sigma/Elastic rules for ATT&CK technique staleness
+  (timestamp drift, semantic drift, opt-in LLM diff proposals).
+- `coverage` — map rules to the ATT&CK matrix (full/shallow/gap) with
+  CTID-weighted priority gating and Navigator export.
+- `backtest` — adversarial replay against the bundled Mordor corpus with
+  Sigma + Elastic (EQL/KQL) matchers and two CI gates.
+- `audit` — one-step composite gate over stale + coverage + backtest.
+- `cti ingest` registered as a stub (Q3–Q4 2026).
+
+### Fixed
+- Sigma matcher correctness: plain-value wildcards, `all/1/N of them`,
+  case-insensitive matching, int/str coercion, list-valued fields, `field: null`.
+- Backtest security: SHA256 verified before extraction, decompression size
+  caps, local-source path sanitization.
+- Stale: undated rules no longer false-gate as critical; malformed tags/threat
+  no longer abort the scan; threshold range validation.
+- Coverage/audit: empty/mistyped priority list is a loud error; sub-technique
+  coverage rolls up to parents; audit honors per-subcommand config + gate flags.
+
+[Unreleased]: https://github.com/jamesbower/Detect-Forge/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/jamesbower/Detect-Forge/releases/tag/v0.1.0

detect_forge-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 James Bower
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.