- Notifications
You must be signed in to change notification settings - Fork0
osuide/detection-coverage-validator
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
A multi-cloud security detection coverage analysis platform that provides visibility into MITRE ATT&CK coverage across AWS environments.
Detection Coverage Validator automatically discovers security detections in your cloud environment, maps them to MITRE ATT&CK techniques, and provides actionable coverage insights.
- Automated Discovery: Scans AWS CloudWatch Logs Insights queries and EventBridge rules
- MITRE ATT&CK Mapping: Pattern-based mapping with confidence scoring
- Coverage Analysis: Tactic and technique coverage visualization
- Gap Identification: Risk-prioritized security gaps
- Dashboard: Interactive coverage heatmap and reports
┌─────────────────────────────────────────────────────────────────┐│ Frontend (React) │├─────────────────────────────────────────────────────────────────┤│ API Gateway + Lambda │├──────────────┬──────────────┬──────────────┬───────────────────┤│ Scanner │ Mapper │ Analyzer │ Reporter ││ (Fargate) │ (Lambda) │ (Lambda) │ (Lambda) │├──────────────┴──────────────┴──────────────┴───────────────────┤│ PostgreSQL (RDS) + Redis │└─────────────────────────────────────────────────────────────────┘- Python 3.11+
- Node.js 18+
- Docker & Docker Compose
- AWS CLI configured
- Terraform 1.5+
# Clone the repositorygit clone https://github.com/osuide/detection-coverage-validator.gitcd detection-coverage-validator# Start local servicesdocker-compose up -d# Backend setupcd backendpython -m venv .venvsource .venv/bin/activatepip install -r requirements.txtalembic upgrade headuvicorn app.main:app --reload# Frontend setup (new terminal)cd frontendnpm installnpm run dev
cd infrastructure/terraformterraform initterraform planterraform apply├── backend/ # Python FastAPI application│ ├── app/│ │ ├── api/ # REST API endpoints│ │ ├── core/ # Configuration, security│ │ ├── models/ # SQLAlchemy models│ │ ├── scanners/ # Cloud detection scanners│ │ ├── mappers/ # MITRE mapping engine│ │ └── analyzers/ # Coverage analysis│ ├── alembic/ # Database migrations│ └── tests/ # pytest tests├── frontend/ # React application│ ├── src/│ │ ├── components/ # React components│ │ ├── pages/ # Page components│ │ └── services/ # API clients├── infrastructure/ # Terraform + Docker│ ├── terraform/ # AWS infrastructure│ └── docker/ # Container definitions└── agents/ # Design documentsOnce running, access the API documentation at:
- Swagger UI:http://localhost:8000/docs
- ReDoc:http://localhost:8000/redoc
Environment variables:
| Variable | Description | Default |
|---|---|---|
DATABASE_URL | PostgreSQL connection string | - |
REDIS_URL | Redis connection string | - |
AWS_REGION | Default AWS region | eu-west-2 |
CONFIDENCE_THRESHOLD_COVERED | Threshold for "covered" | 0.6 |
CONFIDENCE_THRESHOLD_PARTIAL | Threshold for "partial" | 0.4 |
MIT
About
Multi-cloud security detection coverage analysis platform for MITRE ATT&CK
Resources
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Releases
No releases published
Packages0
No packages published
Uh oh!
There was an error while loading.Please reload this page.