opseclint 0.1.1

Detection-coverage analyzer for Linux/auditd, Windows/Sysmon, and macOS/Endpoint Security: resolve shell/command actions to ATT&CK techniques, the telemetry they emit, and the detections that would fire.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

# Contributing to opseclint

Thanks for your interest! The most valuable contributions are **new detection
coverage** and **fixes to false positives/negatives** — most of which are data
changes, not code.

## Development setup

opseclint is a single Rust crate (edition 2024, stable toolchain).

```bash
cargo build
cargo test
```

Before opening a PR, run the same gates CI enforces:

```bash
cargo fmt --all --check
cargo clippy --all-targets -- -D warnings
cargo test
```

`main` is protected: open a pull request and let CI (`build & test` and
`sigma live enrichment`) go green before merging.

## Adding detection coverage (the common case)

Coverage lives in the per-platform knowledge bases:

- `data/knowledge.json` — Linux / auditd
- `data/knowledge-windows.json` — Windows / Sysmon
- `data/knowledge-macos.json` — macOS / Endpoint Security

Each entry maps a command (or a raw pattern) to ATT&CK technique(s), the
telemetry it emits, representative Sigma-style detections, and a detectability
score:

```json
{
  "id": "short-kebab-id",
  "command": "curl",
  "args_contains": "urlcache",
  "description": "One line: what a defender would observe.",
  "techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
  "telemetry": ["the concrete host event(s) this produces"],
  "detections": [{ "source": "Sigma", "rule": "...", "confidence": "high" }],
  "noise": 60
}
```

An entry matches either by `command` (with optional `args_contains` /
`raw_contains` refinements) or by `raw_contains` alone. Keep `id`s unique within
a file, and add a matching test in `src/analyzer.rs` when you introduce a
notable technique.

## Guidelines

- Cite real ATT&CK technique IDs; keep detection references representative and
  honest about confidence.
- Tune `noise` (0–100) to reflect how strongly an action surfaces in telemetry,
  not how "bad" it is.
- **Scope:** opseclint describes *detectability* — what a defender would see. It
  does **not** recommend evasions. Pull requests that add "how to be quieter /
  defeat this detection" guidance are out of scope and won't be merged.

## Reporting bugs and requesting coverage

Use the issue templates (Bug report / Coverage request). For security issues,
see [SECURITY.md](SECURITY.md). For questions and ideas, use
[Discussions](https://github.com/Gerrrt/opseclint/discussions).