Research & findings
Standing analyses, discovery passes and campaign reports generated from the corpus and the lab ledger. Every figure traces to a cited source or a lab run; reports are regenerated, never hand-edited.
Standing analyses
Coverage & Detection Gaps — standing analysis
_Discovery Engine (Phase 3) · miner: gaps · seed 1729 · source DB git_commit 92a83fc
Coverage map — technique × detection status
_Phase 8 · red-team ↔ blue-team loop · source DB git_commit 58a372e (built 2026-10-02, 633 attacks) · plan lab/emulation/plan.yaml · generated from analysis/output/coverage.json._
Defensive Choke Points — standing analysis
_Discovery Engine (Phase 3) · miner: graph-centrality · seed 1729 · source DB git_commit 92a83fc
Detectability: measured in the lab vs. predicted from public content
_As of DB build 2026-10-02. Generated by analysis/detectability_check.py._
FP/noise baseline + noise-adjusted grades, 2026-10-27 wave (run-2026-10-27-001..033)
Owner: detection-analyst. Reproduce: python -X utf8 analysis/noise_baseline.py --date 2026-10-27 [--json].
Risk Hotspots — standing analysis
_Discovery Engine (Phase 3) · miner: gaps · seed 1729 · source DB git_commit 92a83fc
Taming the Windows noise floor: rule 60107 and lab rule 100230 (2026-10-30)
Owner: detection-engineer. Closes the analysis half of the P0 roadmap task "Tame Windows baseline
Standing analysisThreat Hunt — 2026-10-12 (cross-run, read-only)
Proactive hunt for activity that nothing flagged — the residue of successful evasions and
Standing analysisDiscovery passes
Campaign reports
Backlog baseline batch — Windows detectability gaps
The first high-volume measurement batch: 23 Windows backlog techniques — ones the emulation plan
Campaign reportResearch report — campaign detection-loop-2026-10-11
_Narrative report, drafted 2026-10-13 from ledger item led-b9bd61b99b62, the run bundles, lab/config/wazuh/rules/local_rules.xml and lab/config/wazuh/sigma-mapping.md. Proposal for human review; nothing here is deployed by this document. Not a deterministic projection: hand-written, every claim cites a ledger event, run id or rule._