Purple Team & Adversary Emulation

Evidence contract

detection_validator.py scores supplied outcomes; it does not execute detection rules or adversary techniques. Provide boolean executed, valid technique IDs, known outcomes, and non-negative finite detection times. --attack-version sets Navigator metadata (legacy default 15); it does not validate IDs against a release.

Separate observed, inferred, and unverified conclusions. For each finding, record the source/artifact reference, SHA-256 when a file is available, collection time, validation performed, limitations, and next verification step. Extraction confidence is not maliciousness confidence; unknown maliciousness stays unknown. Generated queries/rules are unverified until tested against the intended backend and labeled positive/negative fixtures. Never present simulated results as live evidence.