art_map_conditions
Cross-reference Sigma rule detection conditions against Atomic Red Team test artifacts to generate a match matrix, classifying each condition and identifying tests the rule would miss.
Instructions
Static analysis: parse a Sigma rule's detection conditions and cross-reference each one field-by-field against Atomic Red Team test artifacts. Returns a structured match matrix showing which conditions are MATCHED (verified against ART command text), INFERRED (parent process from executor type), UNABLE_TO_VERIFY (registry/network/access mask — ART doesn't record these), or NOT_IN_ART (no test covers this pattern). Also identifies ART tests the rule would miss. Pure string analysis — never executes anything.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sigma_rule | Yes | Full Sigma rule YAML text (the complete rule, not just the detection block) | |
| technique_id | Yes | MITRE technique ID to match against (e.g., "T1059.001", "T1140") |