HomeDetection topic

Detection engineering and versioned ThreatFade detection packs

How ThreatFade structures detection packs, evidence, ATT&CK mapping and a research-to-production lifecycle.

Evidence statusvalidated

What ThreatFade documents

ThreatFade detection packs use stable identifiers and versioning. The intended lifecycle is Research → Backtest → Canary → Production → Deprecated.

Evidence boundary

Project validation is presented with its scope. Repository tests and author-confirmed scenarios do not establish universal accuracy, independent assurance, customer-scale performance or certification.