# Clone the repo
git clone https://github.com/the2dl/nanodac.git
cd nanodac

# Install dependencies and build
npm install
npm run build

# Run commands via npx
npx nanodac <command>

mkdir my-detections && cd my-detections
git init
npx nanodac init

my-detections/
├── nanodac.config.yaml
├── detections/
│   └── examples/
│       └── brute_force_ssh.yaml
└── .github/
    └── workflows/
        └── detection-sync.yml

apiUrl: https://nanosiem.example.com:3001
searchUrl: https://nanosiem.example.com:3002
detectionsDir: ./detections
defaults:
  severity: medium
  mode: staging

export NANOSIEM_API_KEY=your-api-key

---
title: brute_force_ssh
description: Detects SSH brute force attempts with 10+ failed logins from single IP
author: security-team
severity: high
mode: staging
detection_mode: scheduled
schedule: "*/5 * * * *"
lookback: 15m
mitre_tactics: TA0006
mitre_techniques: T1110
risk_score: auto
risk_entity: src_ip
tags:
  - authentication
  - brute_force

ai_triage_hints:
  ignore_when:
    - "Source IP is a known security scanner"
    - "User is a service account with expected auth patterns"
  suspicious_when:
    - "Multiple usernames targeted from same IP"
    - "Activity occurs outside business hours"
  context: "SSH brute force can trigger on legitimate password recovery. Check if user recently requested password reset."
---
source_type=ssh_logs
  | where action="login_failed"
  | stats count() as attempts,
          values(user) as targeted_users,
          min(timestamp) as first_attempt,
          max(timestamp) as last_attempt
    by src_ip
  | where attempts > 10

# Validate all detections
nanodac validate

# Validate specific files
nanodac validate detections/malware/*.yaml

# Strict mode - treat warnings as errors
nanodac validate --strict

# Test with 7-day lookback (default)
nanodac test detections/brute_force_ssh.yaml

# Test last 24 hours
nanodac test detections/brute_force_ssh.yaml --hours 24

# Show all matching events
nanodac test detections/brute_force_ssh.yaml --all

# Show specific fields only
nanodac test detections/brute_force_ssh.yaml --fields src_ip,user,attempts

# Compact output
nanodac test detections/brute_force_ssh.yaml --compact

# Summary of differences
nanodac diff

# Detailed diff output
nanodac diff --verbose

# Preview changes (dry-run)
nanodac sync --dry-run

# Deploy changes
nanodac sync

# Skip confirmation prompts
nanodac sync --force

# Delete remote rules not in local files
nanodac sync --delete-orphans

git checkout -b detect/lateral-movement-psexec

---
title: psexec_remote_execution
description: Detects PsExec lateral movement to remote hosts
author: jane.doe@company.com
severity: high
mode: staging
detection_mode: scheduled
schedule: "*/5 * * * *"
lookback: 15m
mitre_tactics: TA0008
mitre_techniques: T1021.002
risk_score: 75
risk_entity: dest_host
tags:
  - lateral_movement
  - psexec

ai_triage_hints:
  ignore_when:
    - "Destination is a jump server for admin access"
    - "User is in approved admin group with documented access"
    - "Activity matches known deployment automation"
  suspicious_when:
    - "User has never accessed this host before"
    - "Destination host is sensitive (DC, file server)"
    - "Activity occurs outside business hours"
  context: "PsExec is legitimate admin tool but commonly used by attackers. Verify user had business need for remote access."
---
source_type=windows_security
  | where event_id=4688
  | where process_name CONTAINS "psexec"
  | stats count() as executions,
          values(dest_host) as targets,
          min(timestamp) as first_seen,
          max(timestamp) as last_seen
    by src_host, user
  | where count(targets) > 1

# Check for errors
nanodac validate detections/lateral_movement/psexec_execution.yaml

# Test against last 14 days
nanodac test detections/lateral_movement/psexec_execution.yaml --days 14

git add detections/lateral_movement/psexec_execution.yaml
git commit -m "feat(detection): add PsExec lateral movement detection

Detects PsExec usage to multiple remote hosts from single source.
Maps to MITRE T1021.002 (Remote Services: SMB/Windows Admin Shares).

Tested against 14 days of data: 3 matches, all expected admin activity."

git push -u origin detect/lateral-movement-psexec

name: Detection Sync

on:
  push:
    branches: [main]
    paths: ['detections/**']
  pull_request:
    paths: ['detections/**']

jobs:
  validate:
    name: Validate Detections
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - name: Validate detections
        uses: ./.github/actions/nanodac
        with:
          nanosiem-url: ${{ secrets.NANOSIEM_URL }}
          api-key: ${{ secrets.NANOSIEM_API_KEY }}
          action: validate
          github-token: ${{ secrets.GITHUB_TOKEN }}

  deploy:
    name: Deploy Detections
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Deploy detections
        uses: ./.github/actions/nanodac
        with:
          nanosiem-url: ${{ secrets.NANOSIEM_URL }}
          api-key: ${{ secrets.NANOSIEM_API_KEY }}
          action: deploy

## Detection Validation Results

| Status | Count |
|--------|-------|
| Valid | 5 |
| Warnings | 1 |
| Errors | 0 |

### Warnings

**detections/risky_rule.yaml**
- mitre: No MITRE ATT&CK mappings specified

### Test Results

| Detection | Matches (7d) | Status |
|-----------|--------------|--------|
| brute_force_ssh | 12 | OK |
| psexec_execution | 3 | OK |

{
  "mcpServers": {
    "nanodac": {
      "command": "node",
      "args": ["/Users/you/nanodac/packages/mcp-server/dist/index.js"],
      "env": {
        "NANOSIEM_API_URL": "https://nanosiem.example.com:3001",
        "NANOSIEM_SEARCH_URL": "https://nanosiem.example.com:3002",
        "NANOSIEM_API_KEY": "your-api-key"
      }
    }
  }
}

{
  "mcpServers": {
    "nanodac": {
      "command": "node",
      "args": ["/Users/you/nanodac/packages/mcp-server/dist/index.js"]
    }
  }
}

# Create an issue for detection tuning
nanodac issue create \
  --title "Tune brute_force_ssh - false positives from scanners" \
  --body "Detection triggering on security scanners. Need to add exclusions." \
  --labels detection,tuning,false-positive

# List open detection issues
nanodac issue list --labels detection

detections/
├── authentication/
│   ├── brute_force_ssh.yaml
│   ├── failed_mfa.yaml
│   └── impossible_travel.yaml
├── lateral_movement/
│   ├── psexec_execution.yaml
│   └── wmi_process_creation.yaml
├── malware/
│   ├── known_bad_hashes.yaml
│   └── suspicious_powershell.yaml
└── data_exfiltration/
    ├── large_upload.yaml
    └── cloud_storage_access.yaml

feat(detection): add PsExec lateral movement detection
fix(detection): reduce brute_force_ssh false positives
tune(detection): adjust dns_tunnel threshold from 100 to 500
docs(detection): add triage hints to suspicious_powershell

# Check match volume over 30 days
nanodac test detections/new_rule.yaml --days 30 --all | wc -l

# Review samples
nanodac test detections/new_rule.yaml --limit 10

ai_triage_hints:
  ignore_when:
    - "Source is known security tool (scanner, EDR)"
    - "Activity matches documented automation"
    - "User is in approved exception list"
  suspicious_when:
    - "First time user accessed this system"
    - "Activity outside business hours"
    - "Multiple systems affected in short timeframe"
  context: "Background information helping analysts understand what to investigate."

Error: YAML parse error at line 15

Error: title is required

Warning: mitre_tactics should be TA#### format

Error: Invalid API key

Error: Query parse error at position 42

Warning: Detection 'brute_force_ssh' already exists with different ID