Version-controlled threat intelligence — from first call to deployed Sigma rule.Why This Methodology ExistsMost CTI work degrades in three predictable ways:The evidence problem. An analyst writes “the adversary used T1078” in a report. Six months later nobody can answer: what log line supports that claim? Was it confirmed or inferred? What...