SOC Operations & Automated Incident Response
Problem Statement
When a novel Threat Intelligence report or CISA Advisory is released containing new Adversary Tactics, Techniques, and Procedures (TTPs), threat hunters must manually translate those TTPs into vendor-agnostic Sigma detection rules. This process is time-consuming, creating a gap between threat awareness and active telemetry coverage.
Goal
Build an agent that ingests raw CISA/Threat Intel text, extracts adversary behaviors, and auto-generates validated, syntactically correct Sigma detection rules (YAML) ready for deployment into SIEM environments.
Outcome Measurement
- Rule Generation Time: Threat-intel-to-Sigma pipeline execution time cut from 6 hours to < 1 minute.
- Format Adherence: 100% compliance with official YAML Sigma Rule Specification.
How the Code was Built
Uses Pydantic model definitions reflecting exact Sigma YAML schema structures (title, logsource, detection, condition, falsepositives, level).
Executable Code
import yamlfrom pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass SigmaRuleSchema(BaseModel): title: str = Field(description="Title of detection rule") id: str = Field(description="UUID v4 string for rule") status: str = Field(default="experimental") description: str = Field(description="Detailed threat context") author: str = Field(default="Automated AI Agent") logsource: dict = Field(description="Dict with category, product, etc.") detection: dict = Field(description="Detection logic dictionary containing search selections and condition") falsepositives: list[str] = Field(description="Potential benign operational triggers") level: str = Field(description="low, medium, high, critical")def generate_sigma_rule(intel_report: str) -> str: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(SigmaRuleSchema) prompt = f"Analyze this Threat Intelligence report and build a valid Sigma Detection Rule:\n{intel_report}" sigma_obj = structured_llm.invoke(prompt) return yaml.dump(sigma_obj.model_dump(), sort_keys=False)if __name__ == "__main__": sample_intel = """Adversaries are actively exploiting CVE-2026-99999 by executing custom binary 'malware_updater.exe'from the 'C:\Users\Public\Downloads\' path. Upon execution, it adds a persistent registry key under'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' named 'SystemUpdateService'.""" yaml_rule = generate_sigma_rule(sample_intel) print("Generated Sigma Rule (YAML):\n") print(yaml_rule)
Leave a Reply