detection-validation

Plugin detection-validation from marketplace zero-lab in zero-lab-ai/skills. Commands read from the repo's manifest — 19 days ago.

Skills (6)

• defensive-control-evidence-synthesis

  Synthesizes supplied evidence-backed defensive assessment results and administrative receipts into a scope-bound control-evidence matrix that preserves lineage, freshness, contradictions, unknowns, and gaps. Use when consolidating defensive control evidence without scanning, scoring, certifying, or

• detection-engineering

  Builds detection rules that are proven before they ship — fire on known-bad, stay silent on known-good — and keeps false positives from blinding the SOC. Use when writing a Sigma/Suricata/YARA rule, reviewing a detection before deployment, triaging alert fatigue, or deciding whether a rule has earne

• detection-resilience-test-plan

  Plans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-approved opaque technique variations. Use when a blue or purple team needs authorization-, safety-, evidence-, cleanup-, and remediation-gated resilience measurement withou

• detection-validate

  Runs attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that separates real gaps from accepted ones. Use when running a purple-team exercise, measuring detection coverage, validating that a SOC can see a technique, or turning 'we think we're co

• incident-validation-correlation

  Correlates supplied sanitized incident observations with separately approved isolated defensive-validation receipts across prevent, observe, detect, contain, and recover. Use for defensive learning comparison without live response, hunting, technique design or execution, detection authoring, case ma

• telemetry-coverage-audit

  Audits supplied sanitized passive telemetry evidence for policy-defined visibility, retention, custody, and investigation readiness. Use when reviewing evidence quality or profile-specific telemetry usability without contacting sources or claiming detection coverage.