luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add rule event compatibility tests

Browse source
This commit is contained in:
Luna 2026-07-08 17:09:00 -07:00
parent 66472134d8
commit a7535cfc56
2 changed files with 83 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/ROADMAP.md
View file

@ -175,7 +175,7 @@ turning Sentinel into a noisy rules dump.
event type, match fields, expected false positives, and drill coverage.
- ✅ Require a fixture or safe red-team drill for every built-in SID, including
event-only and correlation SIDs.
- Add compatibility tests for rule JSON/event schema evolution.
- ✅ Add compatibility tests for rule JSON/event schema evolution.
- ✅ Extend triage so false-positive suggestions are tied to SID/classtype and can
emit TOML snippets for allowlists, correlation windows, or severity overrides.
- ✅ Add post-alert enrichment consistently across detections: