Capstone: Test, Tune and Map a Detection

Deploy a real lab, test a draft Sigma rule against recorded endpoint telemetry, tune out the documented false positive, confirm the true positive, update the ATT&CK coverage, and capture the flag.