Detection engine — Sigma and native rule matching plus YARA over a normalized forensic timeline; detections emitted as events. Part of the Citadel suite.
