How ctum0/detection-lab works
detection-lab is a detection-engineering repository centered on Sigma rules, with Wazuh and Splunk rule outputs and documented validation scenarios. The principal workflow is authoring Sigma detections, translating them into platform-specific rules, and deploying Wazuh rules; attack scenarios and detection writeups capture validation. The README documents CI-based SPL generation and Wazuh deployment, but their internal wiring is not shown in the sampled source, so those links reflect only documented behavior.
Main entry points: sigma Sigma rules · splunk Splunk searches · sigma_to_wazuh.py Sigma to Wazuh · deploy-wazuh.yml Wazuh deployment
Components 12
Detection authoring
- Sigma rules
detections/sigma - Sigma to Wazuh
converters/sigma_to_wazuh.py
Detection platforms
- Wazuh rules
detections/wazuh/custom_rules.xml - Splunk searches
detections/splunk
Validation
- Attack scenarios
attack-tests - Detection writeups
docs/detections - Validation evidence
evidence
Deployment automation
- Wazuh deployment
.github/workflows/deploy-wazuh.yml - Sigma validation and SPL generation
.github/workflows/validate.yml
Other components
- Detection engineer
- Wazuh manager
- Splunk
Connections 11
- Detection engineer → Sigma rules: authors
- Sigma to Wazuh → Sigma rules: reads
- Sigma to Wazuh → Wazuh rules: generates
- Sigma rules → Splunk searches: converts to
- Wazuh deployment → Wazuh rules: uploads
- Wazuh deployment → Wazuh manager: deploys to
- Sigma validation and SPL generation → Sigma rules: validates
- Sigma validation and SPL generation → Splunk searches: generates
- Splunk searches → Splunk: searches
- Attack scenarios → Detection writeups: validate scenarios
- Detection writeups → Validation evidence: indexes evidence