Next-Gen Detection: Harnessing LLMs for Sigma Rule Automation
summary
A project scrapes 200 threat-intel reports, extracts 624 attack procedures and narrows them to ~183 usable procedures, then compares three LLM strategies: RAG using the Sigma HQ repo with embeddings stored in ChromaDB (mean score 8.09), prompt-chaining (mean 7.84, ~90s per rule), and fine-tuning (costly, failed on 3.5-turbo after ~$60 of runs). Automated QA uses an LLM to score precision, real-world applicability and alignment; a public repo named siggen 2gs hosts the pipeline and examples.
AI-written summary · about
chapters (9)
- 0:00Introduction and objective
- 4:09Data quality and preparation
- 7:38Data collection methodology
- 10:06Retrieval augmented generation
- 16:52Prompt chaining technique
- 19:57Fine-tuning experiments
- 24:26Evaluating strategy results
- 29:41Future directions
- 32:36Q&A session
related talks
31mEnhancing Secret Detection in Cybersecurity...
47mHarnessing LLMs for Next-Level Security Analysis
13mIntegrating Large Language Models into Security Incident Response
40mWhat Does an LLM-Powered Threat Intelligence Program Look Like?
39mThreat Modeling Using LLMs
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
37mSecure by Design: Strategies for LLM Adoption in Cloud-Native Environm...
47mA Step-by-Step Guide to Securing Large Language Models (LLMs)