MVP polish: TLS rule RS-TLS-001, deploy script, status badge (#153)

[TFT444]

Summary

Three focused improvements to bring RetailShield to professional MVP standard.

Change 1 — TLS Downgrade / Weak Cipher KQL rule

File: detection-rules/retail/tls_downgrade_pos.kql

Rule RS-TLS-001 detects POS endpoints negotiating TLS 1.0/1.1 or weak cipher suites (RC4, DES, 3DES, NULL, EXPORT, anon). Directly maps to PCI-DSS v4.0 requirement 4.2.1 — strong cryptography for cardholder data in transit.

• MITRE ATT&CK: T1557 — Adversary-in-the-Middle
• Tactic: Credential Access / Collection
• Severity: High (escalates to Critical if > 20 events from same source)
• Source table: CommonSecurityLog (firewall/proxy CEF connector)
• Lookback: 1 hour, runs every 30 minutes
• Rule count: 23 → 24 (all 24/24 pass validate_kql.py)

Change 2 — One-command deployment script

File: scripts/deploy_all.py

Deploys all RetailShield analytics rules to a target Sentinel workspace via azure-mgmt-securityinsight. Supports --dry-run to preview without deploying.

python scripts/deploy_all.py --workspace <name> --resource-group <rg>
python scripts/deploy_all.py --workspace <name> --resource-group <rg> --dry-run

Change 3 — Status badge

File: README.md

In Development (yellow) → Active MVP (brightgreen)

How to test

# KQL validator — should show 24/24
python scripts/validate_kql.py

# Deploy script syntax check
python -c "import ast; ast.parse(open('scripts/deploy_all.py').read()); print('OK')"

Closes #153

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
retail-shield	Ready	Preview, Comment	Jun 23, 2026 5:44pm