RedGap
Automated MITRE ATT&CK offense ↔ detection coverage · v0.1

Find the red gaps
in your detection.

Does your detection actually fire? Prove it — don't assume it.

RedGap runs a set of benign ATT&CK techniques against its own disposable local lab, collects real telemetry with an independent collector, then deterministically — from logs and Sigma rules, with no AI in the loop — decides whether each technique was detected or is a gap. The verdict is a pure function of (events, rules), written to disk before any language model is ever called.

$ pip install redgap See a live run ↓ View source ↗
26
techniques detected
12
coverage gaps found
122
real SigmaHQ rules parsed, 0 crashes
290
tests, run fully offline
The run

38 techniques, mapped onto the ATT&CK matrix

This is a real REPLAY run over committed telemetry — 26 detected, 12 gaps, and two kinds of gap, because a coverage tool that is all-green is just a checklist. Flip to after --fix to watch the remediation round-trip close the timestomp gap live.

Run redgap run and drop your own out/coverage.json here to see your coverage grid. It is parsed in your browser — nothing is uploaded, it never leaves your machine.
detected gap · rule (closeable) gap · base-rate (needs correlation) tactic not yet tested

38 techniques executed with real telemetry across 11 of the 14 ATT&CK enterprise tactics; each verdict is computed by the engine from captured logs against real SigmaHQ rules.

ATT&CKTechniqueTacticResultFiring rule / gap
The one idea

The verdict is not the AI's to make

LLMs hallucinate confident verdicts. A coverage tool whose ground truth a model can fabricate is worthless — so RedGap draws the trust boundary in code. The optional planner can order the techniques and narrate the report; it cannot change a single verdict. A test asserts the coverage is byte-identical with and without the LLM.

LLM planner · optional
orders techniques · narrates — cannot set a verdict
▲ read-only · chooses next ▲
Technique catalog
38 benign · MITRE-mapped
Lab
disposable Docker · no network
Collector
independent LD_PRELOAD execve shim
Sigma engine
deterministic · verdict = f(logs, rules)
Coverage → reports
JSON · Markdown · Navigator
The point

Find a real blind spot — then close it

Technique T1070.006 (timestomp) fires, but no rule catches it: a rule gap. Write one Sigma rule, re-run the same command, and the verdict flips red → green. Both the before and after reports are committed. RedGap isn't a status printer — it's a loop that finds a gap and closes it.

before
$ redgap run # T1070.006 Timestomp ● gap (rule) # 26/38 detected · 12 gaps
after — one rule added
$ redgap run --fix # T1070.006 Timestomp ● detected # 27/38 detected · 11 gaps
Run it

One command. No key, no cloud, no Docker.

The default path re-evaluates real captured telemetry (committed with sha256 provenance) through the exact same engine used live. Docker is only needed for a fresh live capture.

offline coverage run
$ pip install redgap $ redgap run # REPLAY, prints the table + writes reports $ redgap run --fix # close the timestomp gap: red → green

From source instead: git clone … && pip install -e .

live against the disposable lab
$ redgap run --live # needs Docker Desktop # builds a throwaway Debian container, # runs the techniques, captures real # telemetry, tears the container down

The lab builds and destroys itself — nothing to set up by hand.