[defamp]

Summary

Test-only changes from a review of the repo. It was already in good shape, so this closes two gaps.

• IPv6 samples: the Python parser already accepts IPv6 (from (\S+) port), but no sample exercised it. A related tool (logsleuth) turned out to silently drop IPv6 attackers, so it's worth pinning here too:
  • ssh_failed_password: failed password from 2001:db8::7 → match
  • ssh_bruteforce: 6 failures from 2001:db8::7 within 25 s → alert, grouped by the IPv6 address
• detlab.scan CLI tests: a new tests/test_scan_cli.py covers file input, stdin (-), --year, the skipped-line count and the exit codes. scan.py coverage goes from 71% to 98%.

No rule or engine changes.

Testing

• Locally: pytest passes (119 tests), and ruff check, ruff format --check and python -m detlab.coverage --check are clean.
• Not run locally:
  • sigma check needs to download MITRE ATT&CK data, which the dev sandbox's network blocked. This PR changes no rule files.
  • The Wazuh logtest workflow couldn't run here (no Docker daemon). It is the real check for the IPv6 cases: it verifies that Wazuh's built-in sshd decoder extracts an IPv6 srcip for the correlation. If it fails, that's a genuine gap in the Wazuh rules to discuss, not something to paper over with wazuh_skip.

Not changed (owner's call)

All 11 rules are still status: experimental. Promoting them to test or stable depends on how long they've run against real data, so I left that to you.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FQvnacbQuWZv9PUmgednWt

---

Generated by Claude Code