Research Android threats and author validated SIGMA rule/IOC candidates

Continuous threat intel pipeline that keeps SIGMA rules fresh against emerging Android malware with human-in-the-loop final gate

• · live feed state {cursors, discover_cursors, since date, next_id, rule_index}
• · today date, tracked threat names (comma-separated)

• · SIRs (Structured Incident Reports) array
• · SIGMA rule + IOC data candidates {id, threat, fixture, verdict}
• · updated cursors per feed

• · git
• · Bash/Glob for fixture compilation (per-threat)
• · ABuse.ch, ASB, NVD, stalkerware databases (external feeds)
• · Kotlin-mirror-feeds (OPFS local cache)

• · Feed-state.json live (cursors refreshed before invoke)
• · SIGMA rule index up-to-date
• · MVT STIX parser (Kotlin mirror) available

• · Candidate already exists in tracked threats (duplicate)
• · Fixture doesn't compile or run
• · Feed cursor stale (backfill needed)
• · Dedup gate fails to recognize variants

• · 6-phase Ingest → Discover → Research → Author → Dedup → Validate
• · Gate 1/1.2/2/3 + independent Gate-5 reviewer per candidate
• · Cursors managed per source (abuse.ch, ASB, NVD, stalkerware, ATT&CK, Amnesty)
• · REQUIRED_ARGS guard prevents stale cursor runs