cortado

Cortado is a Python-based framework designed for executing Red Team Automations (RTAs) which emulate attacker behaviors or reference specific binary samples to evaluate detection rules in Elastic's security products. It features a command-line interface for running RTAs in a minimal dependency environment, as well as utilities for assessing RTA coverage against defined detection rules. The tool facilitates seamless integration and deployment within security operations, enhancing the verification process of alert generation.