[dandye]

Summary

Implements the vendor-neutral Open Security Usecase & Blue Team Evaluation Metadata Standard (schema_version: "2.0") for standardized telemetry replay, cross-platform SIEM/Lakehouse bindings (Google SecOps, Databricks secops_ocsf.*, Sigma, Splunk), and held-out Blue Team agent evaluations:

• Core Schema Models & JSON Schema Exporter (src/logstory/schema/models.py):
  • Implements zero-dependency stdlib + PyYAML models (SecurityUsecaseManifest, SecurityUsecaseEval, ParsedUsecasePackage, parse_usecase_package, export_json_schemas) with strict unknown-key rejection and lossless round-trip serialization.
  • Exports Draft 2020-12 JSON Schemas at schemas/usecase.schema.json and schemas/eval.schema.json.
• 5-Gate Package & Corpus Validator (src/logstory/schema/validator.py):
  • G1_SCHEMA: Structural and enum validation against v2 manifest and evaluation schemas.
  • G2_INTEGRITY: Verifies on-disk telemetry/detection file paths and cross-references kill_chain[].evidence_streams against declared telemetry stream_ids.
  • G3_ANTI_SPOILER: Rejects ground-truth keys inside <USECASE>.md frontmatter and checks that held-out malicious IOCs, compromised accounts, and patient-zero hosts from eval.yaml do not leak above <!-- BEGIN_SOLUTION -->.
  • G4_COUNTERFACTUAL: Verifies bidirectional twin consistency across counterfactual_pair scenarios.
  • G5_LEGACY_V1: Emits upgrade warnings for v1 manifests by default and errors under --strict-v2.
• Documentation Generator v1/v2 Shim & Built-In Usecases (usecases/generate_usecase_docs.py, usecases/usecase_template.j2):
  • Adds normalize_frontmatter_for_template() and a stdlib fallback renderer while migrating built-in usecases/NETWORK_ANALYSIS and usecases/RULES_SEARCH_WORKSHOP to schema_version: "2.0" + eval.yaml.
• CLI Subcommands & Composable Baseline Replay (src/logstory/logstory.py):
  • logstory usecases validate [TARGET] [--strict-v2] [--format text|json]
  • logstory usecases inspect <USECASE> [--blind|--include-eval] [--format text|json]
  • logstory usecases export-schemas [--output-dir DIR]
  • logstory replay usecase <USECASE> --with-paired-baselines
• Companion Corpus Migration PR: https://github.com/dandye/logstory_usecases/pull/2

Verification

• pytest tests/ -v: 237 passed (including 62 new unit, CLI, and 47-scenario corpus tests).
• ruff check . and pyink --check .: 0 issues.