Healthcare-focused detection engineering: signature detections written as Sigma (MITRE ATT&CK-mapped, CI-validated) and ML-driven detections documented as model cards. The detection layer of the Pink Hat SOC platform.
All sample data is synthetic — no PHI.
🚧 Status: actively in development. The repository structure and tooling are in place; detection rules are being authored and added incrementally. The headline content — original DICOM / HL7 / FHIR detections — is the current focus. Watch this repo for updates.
Most detection-rule libraries cover endpoints, Windows, and cloud well — but clinical protocols are a blind spot. DICOM, HL7, and FHIR carry the most sensitive data in a hospital, yet public detection content for protocol abuse and PHI exfiltration over them is almost nonexistent. This repo publishes original, ATT&CK-mapped Sigma rules for those protocols, validated against a real Wazuh / OpenSearch backend, alongside the endpoint detections and ML model cards from the Pink Hat platform.
pinkhat-detections/
├── rules/
│ ├── healthcare/ # original DICOM / HL7 / FHIR detections — the rare part
│ └── endpoint/ # endpoint detections re-authored from Wazuh as portable Sigma
├── ml-detections/ # model cards for the ML-based detections (LSTM/RL, Isolation Forest, RAG)
├── pipelines/ # optional pySigma conversion pipelines
├── docs/
│ └── attack-coverage.md # MITRE ATT&CK coverage matrix
└── .github/workflows/
└── sigma.yml # CI — runs `sigma check` on every push
| Area | Status |
|---|---|
| Repository scaffold + license + CI workflow | ✅ In place |
| Endpoint detections (re-authored from Wazuh → Sigma, ATT&CK-mapped) | 🔄 In progress |
| Original DICOM / HL7 / FHIR detections | 🔄 In progress (headline content) |
| ML detection model cards | ⏳ Planned |
| ATT&CK coverage matrix | ⏳ Planned |
Every rule is plain Sigma YAML and validates with the standard toolchain:
pipx install sigma-cli
sigma check ./rulesThe same check runs automatically in CI on every push (see .github/workflows/sigma.yml).
To convert a rule to a backend query (example, OpenSearch / Wazuh indexer):
sigma convert -t opensearch -p ecs_windows ./rules/endpoint/<rule>.yml- Every rule carries a real
id:(UUID), a populatedauthor:field, and atags:block mapping it to one or more MITRE ATT&CK techniques. - Healthcare rules document the protocol behavior they detect and the (synthetic) telemetry they were tested against.
- No rule contains real IPs, hostnames, credentials, or PHI — only documentation-safe placeholders and synthetic samples.
- 🏥 Platform overview:
pinkhat-soc— architecture, playbooks, and the autonomous SOC agent - 🌐 Project site: https://pinkhat-soc.netlify.app
The detection rules in this repository are released under the Detection Rule License (DRL) 1.1 — the same license SigmaHQ uses for its rule set. In short: use them freely (including commercially), but retain author attribution, including in any tooling that displays rule matches.
Maintained by Adam Chokri — Network Infrastructure & Digital Security (NIDS), ESPRIT.