RedGap
Automated MITRE ATT&CK offense ↔ detection coverage

Find the red gaps in your detection.

Your detections either fire — or they don't. Stop assuming. Prove it.

RedGap runs 51 benign ATT&CK techniques against its own disposable lab, captures real telemetry, and — from logs and Sigma rules, with no AI in the verdict — tells you exactly which techniques your rules catch and which slip through. The verdict is a pure function of (events, rules), computed before any model runs.

34
techniques your rules caught
17
blind spots surfaced
122
real SigmaHQ rules parsed, 0 crashes
324
tests, fully offline in CI
The coverage grid

51 techniques, mapped onto the ATT&CK matrix

A real REPLAY run over committed telemetry: 34 detected, 17 gaps — and two kinds of gap, because an all-green report is just a checklist. The red cells glow — that's what RedGap is for. Or drop your own report below to see your grid.

Run redgap run and drop your own out/coverage.json here — parsed in your browser, nothing is uploaded.
detected gap · rule (write one to close it) gap · base-rate (needs correlation) tactic not yet tested

51 techniques executed with real telemetry across 11 of the 14 ATT&CK enterprise tactics; every verdict is computed by the engine from captured logs against real SigmaHQ rules — never declared. Click any technique for its real telemetry, the rule, and why.

ATT&CKTechniqueTacticResultFiring rule / gap
Practical use

Point it at your own rules — see your own gaps

RedGap ships a demo rule set, but the real workflow is your rules. It's a measuring stick you own: bring the rules, RedGap runs the attacks and shows where they don't meet.

01 · MEASURE

Run it against your rules

Drop your Sigma rules into rules/ and run. Real techniques execute in a throwaway container; the engine grades them against your rules, deterministically.

$ redgap run --live
02 · SEE

Spot the blind spots

Get a coverage grid: green where you're covered, red where an attacker walks past. Upload the coverage.json to this page for the live grid.

# 34/51 detected · 17 gaps
03 · CLOSE

Fix it & gate it in CI

Write the missing rule, re-run, watch the verdict flip redgreen. Wire RedGap into CI so a new gap fails the build.

$ redgap run --fix
The one idea

The verdict is not the AI's to make

LLMs hallucinate confident verdicts. A coverage tool whose ground truth a model can fabricate is worthless — so RedGap draws the trust boundary in code. The optional planner can order the techniques and narrate the report; it cannot change a single verdict. A test asserts the coverage is byte-identical with and without the LLM.

LLM planner · optional
orders techniques · narrates — cannot set a verdict
▲ read-only · chooses next ▲
Technique catalog
51 benign · MITRE-mapped
Lab
disposable Docker · no network
Collector
independent LD_PRELOAD execve shim
Sigma engine
deterministic · verdict = f(logs, rules)
Coverage → reports
JSON · Markdown · Navigator
The point

Find a real blind spot — then close it

12 of the 17 gaps are rule gaps — real telemetry, no rule firing. Write the missing rules, re-run, and every one flips green: 34 → 46. The last 5 are base-rate gaps — honest about needing correlation, not a single-event rule. Both reports are committed. RedGap isn't a status printer — it's a loop that finds gaps and closes them.

before
$ redgap run # T1070.006 Timestomp ● gap (rule) # 34/51 detected · 17 gaps
after — the missing rules written
$ redgap run --fix # T1070.006 Timestomp ● detected # every rule-gap → green # 46/51 detected · 5 gaps (base-rate)
Run it

One command. No key, no cloud, no Docker.

The default path re-evaluates real captured telemetry (committed with sha256 provenance) through the exact same engine used live. Docker is only needed for a fresh live capture.

offline coverage run
$ pip install redgap $ redgap run # REPLAY: prints the grid + writes reports $ redgap run --fix # close the timestomp gap: red → green

From source: git clone github.com/befnoz/redgap && pip install -e .

live against the disposable lab
$ redgap run --live # needs Docker Desktop # builds a throwaway Debian container, # runs the techniques, captures real # telemetry, tears the container down

The lab builds and destroys itself — nothing to set up by hand.