Does your detection actually fire? Prove it — don't assume it.
RedGap runs a set of benign ATT&CK techniques against its own disposable local lab, collects real telemetry with an independent collector, then deterministically — from logs and Sigma rules, with no AI in the loop — decides whether each technique was detected or is a gap. The verdict is a pure function of (events, rules), written to disk before any language model is ever called.
This is a real REPLAY run over committed telemetry. It deliberately produces both detections and two kinds of gap — because a coverage tool that is all-green is just a checklist. Flip to after --fix to watch the remediation round-trip close the timestomp gap live.
5 techniques executed with real telemetry, placed across the 14 ATT&CK enterprise tactics. Expanding the executed set toward the full matrix is the next milestone.
| ATT&CK | Technique | Tactic | Result | Firing rule / gap |
|---|
LLMs hallucinate confident verdicts. A coverage tool whose ground truth a model can fabricate is worthless — so RedGap draws the trust boundary in code. The optional planner can order the techniques and narrate the report; it cannot change a single verdict. A test asserts the coverage is byte-identical with and without the LLM.
Technique T1070.006 (timestomp) fires, but no rule catches it: a rule gap. Write one Sigma rule, re-run the same command, and the verdict flips red → green. Both the before and after reports are committed. RedGap isn't a status printer — it's a loop that finds a gap and closes it.
The default path re-evaluates real captured telemetry (committed with sha256 provenance) through the exact same engine used live. Docker is only needed for a fresh live capture.
From source instead: git clone … && pip install -e .
The lab builds and destroys itself — nothing to set up by hand.