# ctum0/detection-lab architecture

> Architecture diagram of the GitHub repository ctum0/detection-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ctum0/detection-lab
- Repository: https://github.com/ctum0/detection-lab

## Overview

detection-lab is a detection-engineering repository centered on Sigma rules, with Wazuh and Splunk rule outputs and documented validation scenarios. The principal workflow is authoring Sigma detections, translating them into platform-specific rules, and deploying Wazuh rules; attack scenarios and detection writeups capture validation. The README documents CI-based SPL generation and Wazuh deployment, but their internal wiring is not shown in the sampled source, so those links reflect only documented behavior.

Main entry points: [`detections/sigma`](https://github.com/ctum0/detection-lab/tree/main/detections/sigma) (Sigma rules), [`detections/splunk`](https://github.com/ctum0/detection-lab/tree/main/detections/splunk) (Splunk searches), [`converters/sigma_to_wazuh.py`](https://github.com/ctum0/detection-lab/blob/main/converters/sigma_to_wazuh.py) (Sigma to Wazuh), [`.github/workflows/deploy-wazuh.yml`](https://github.com/ctum0/detection-lab/blob/main/.github/workflows/deploy-wazuh.yml) (Wazuh deployment)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_authoring["Detection authoring"]
  node_sigma["Sigma rules"]
  node_converter["Sigma to Wazuh<br/>[sigma_to_wazuh.py]"]
end

subgraph group_platforms["Detection platforms"]
  node_wazuh_rules["Wazuh rules<br/>[custom_rules.xml]"]
  node_splunk_rules["Splunk searches"]
end

subgraph group_validation["Validation"]
  node_attack_tests["Attack scenarios"]
  node_detection_docs["Detection writeups"]
  node_evidence["Validation evidence"]
end

subgraph group_automation["Deployment automation"]
  node_deploy_workflow["Wazuh deployment<br/>[deploy-wazuh.yml]"]
  node_validate_workflow["Sigma validation and SPL generation<br/>[validate.yml]"]
end

node_engineer(("Detection engineer"))
node_wazuh_manager["Wazuh manager"]
node_splunk["Splunk"]

node_engineer -->|"authors"| node_sigma
node_converter -->|"reads"| node_sigma
node_converter -->|"generates"| node_wazuh_rules
node_sigma -->|"converts to"| node_splunk_rules
node_deploy_workflow -->|"uploads"| node_wazuh_rules
node_deploy_workflow -->|"deploys to"| node_wazuh_manager
node_validate_workflow -->|"validates"| node_sigma
node_validate_workflow -->|"generates"| node_splunk_rules
node_splunk_rules -.->|"searches"| node_splunk
node_attack_tests -->|"validate scenarios"| node_detection_docs
node_detection_docs -->|"indexes evidence"| node_evidence

click node_sigma "https://github.com/ctum0/detection-lab/tree/main/detections/sigma"
click node_converter "https://github.com/ctum0/detection-lab/blob/main/converters/sigma_to_wazuh.py"
click node_wazuh_rules "https://github.com/ctum0/detection-lab/blob/main/detections/wazuh/custom_rules.xml"
click node_splunk_rules "https://github.com/ctum0/detection-lab/tree/main/detections/splunk"
click node_attack_tests "https://github.com/ctum0/detection-lab/tree/main/attack-tests"
click node_detection_docs "https://github.com/ctum0/detection-lab/tree/main/docs/detections"
click node_evidence "https://github.com/ctum0/detection-lab/tree/main/evidence"
click node_deploy_workflow "https://github.com/ctum0/detection-lab/blob/main/.github/workflows/deploy-wazuh.yml"
click node_validate_workflow "https://github.com/ctum0/detection-lab/blob/main/.github/workflows/validate.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_sigma,node_converter toneBlue
class node_wazuh_rules,node_splunk_rules toneAmber
class node_attack_tests,node_detection_docs,node_evidence toneMint
class node_deploy_workflow,node_validate_workflow toneRose
class node_engineer,node_wazuh_manager,node_splunk toneIndigo
```

## Components

### Detection authoring

- [Sigma rules](https://github.com/ctum0/detection-lab/tree/main/detections/sigma): `detections/sigma`
- [Sigma to Wazuh](https://github.com/ctum0/detection-lab/blob/main/converters/sigma_to_wazuh.py): `converters/sigma_to_wazuh.py`

### Detection platforms

- [Wazuh rules](https://github.com/ctum0/detection-lab/blob/main/detections/wazuh/custom_rules.xml): `detections/wazuh/custom_rules.xml`
- [Splunk searches](https://github.com/ctum0/detection-lab/tree/main/detections/splunk): `detections/splunk`

### Validation

- [Attack scenarios](https://github.com/ctum0/detection-lab/tree/main/attack-tests): `attack-tests`
- [Detection writeups](https://github.com/ctum0/detection-lab/tree/main/docs/detections): `docs/detections`
- [Validation evidence](https://github.com/ctum0/detection-lab/tree/main/evidence): `evidence`

### Deployment automation

- [Wazuh deployment](https://github.com/ctum0/detection-lab/blob/main/.github/workflows/deploy-wazuh.yml): `.github/workflows/deploy-wazuh.yml`
- [Sigma validation and SPL generation](https://github.com/ctum0/detection-lab/blob/main/.github/workflows/validate.yml): `.github/workflows/validate.yml`

### Other components

- **Detection engineer**
- **Wazuh manager**
- **Splunk**

## Connections

- Detection engineer → Sigma rules: authors
- Sigma to Wazuh → Sigma rules: reads
- Sigma to Wazuh → Wazuh rules: generates
- Sigma rules → Splunk searches: converts to
- Wazuh deployment → Wazuh rules: uploads
- Wazuh deployment → Wazuh manager: deploys to
- Sigma validation and SPL generation → Sigma rules: validates
- Sigma validation and SPL generation → Splunk searches: generates
- Splunk searches → Splunk: searches
- Attack scenarios → Detection writeups: validate scenarios
- Detection writeups → Validation evidence: indexes evidence