What Warden's build replays against it, and how it did.

Replayed at build time

The build-time corpus holds 91 attack variants and 13 benign variants, replayed through the full pipeline. In this run, 91 of 91 attack variants were detected, and the benign variants raised 3 false positives (listed below).

The corpus is part of the product's own source at that commit, written with the rules it tests, and nobody outside Warden has run it. A full score shows that the rules catch the variants written for them and that nothing has slipped; it does not show what an attacker the corpus does not describe would get past.

By rule: 53 detected, 3 with no variant in the corpus (the file marks them not detected: "no self-play variant exercises this rule") and 1 out of scope, of 57. Each row is one detection rule and the variants written to test it; the rule links to its entry in the rules catalogue.

Detection per rule

Benign false positives

The benign variants are ordinary changes that should raise nothing. 1 of the 13 raised 3 findings, and all 3 are false positives. By severity: 1 high, 2 low. Each is shown as the file records it: rule, severity, then the finding.

enclave-host.imdsv2-hop-2

• V-013a high Weak-IMDS instance set grew
• V-013a low EC2 instance metadata hop limit above 1
• V-013a low Weak-IMDS instance set

What this record does not cover

• A real AWS account or cluster: the accounts are synthetic, in the file's own words above.
• An outside or live attacker: every variant is in the product's source and is replayed offline.
• Containment: this record scores detection only.
• V-005: no variant in the corpus (no self-play variant exercises this rule).
• V-007: no variant in the corpus (no self-play variant exercises this rule).
• V-020a: no variant in the corpus (no self-play variant exercises this rule).
• V-019a: out of scope (grades another sensor's findings beside Warden's (GuardDuty parity); there is no adversary act to replay, only a third-party verdict).

How these files are made

Both files come from the product repository's main branch at commit e1e668dc14e8ef60509c4f963bc79707125af0ba. The product repository is private, so these commands need access to it. In a checkout, with Node 22.21 or later, they rebuild both files from the corpus and the rules with the product's own generators, show that they match that commit byte for byte, and print their sha256. Without access, you can still download the copies served here and compare their sha256 with the last column.

git checkout e1e668dc14e8ef60509c4f963bc79707125af0ba
npm ci
npx tsx tools/selfplay/ratchet.ts --write
npx tsx tools/gen-coverage-map.ts --write
npx biome format --write tools/selfplay-score.json techniques.json
git diff --exit-code tools/selfplay-score.json techniques.json
sha256sum tools/selfplay-score.json techniques.json

The files as this page read them: selfplay-score.json (the score: every variant and the findings it raised) and techniques.json (the technique map made from it).