51 techniques, mapped onto the ATT&CK matrix
A real REPLAY run over committed telemetry: 34 detected, 17 gaps — and two kinds of gap, because an all-green report is just a checklist. The red cells glow — that's what RedGap is for. Or drop your own report below to see your grid.
51 techniques executed with real telemetry across 11 of the 14 ATT&CK enterprise tactics; every verdict is computed by the engine from captured logs against real SigmaHQ rules — never declared. Click any technique for its real telemetry, the rule, and why.
| ATT&CK | Technique | Tactic | Result | Firing rule / gap |
|---|
Point it at your own rules — see your own gaps
RedGap ships a demo rule set, but the real workflow is your rules. It's a measuring stick you own: bring the rules, RedGap runs the attacks and shows where they don't meet.
Run it against your rules
Drop your Sigma rules into rules/ and run. Real techniques execute in a throwaway container; the engine grades them against your rules, deterministically.
Spot the blind spots
Get a coverage grid: green where you're covered, red where an attacker walks past. Upload the coverage.json to this page for the live grid.
Fix it & gate it in CI
Write the missing rule, re-run, watch the verdict flip red → green. Wire RedGap into CI so a new gap fails the build.
The verdict is not the AI's to make
LLMs hallucinate confident verdicts. A coverage tool whose ground truth a model can fabricate is worthless — so RedGap draws the trust boundary in code. The optional planner can order the techniques and narrate the report; it cannot change a single verdict. A test asserts the coverage is byte-identical with and without the LLM.
Find a real blind spot — then close it
12 of the 17 gaps are rule gaps — real telemetry, no rule firing. Write the missing rules, re-run, and every one flips green: 34 → 46. The last 5 are base-rate gaps — honest about needing correlation, not a single-event rule. Both reports are committed. RedGap isn't a status printer — it's a loop that finds gaps and closes them.
One command. No key, no cloud, no Docker.
The default path re-evaluates real captured telemetry (committed with sha256 provenance) through the exact same engine used live. Docker is only needed for a fresh live capture.
From source: git clone github.com/befnoz/redgap && pip install -e .
The lab builds and destroys itself — nothing to set up by hand.