Doc-foundry – AI writes Security detection rules, then proves they work (github.com)

Doc-foundry has introduced an innovative AI solution that enables the automated creation and validation of security detection rules. By transforming various threat inputs—such as Common Vulnerabilities and Exposures (CVEs) and incident reports—into executable Sigma detection rules, this system validates the accuracy and robustness of those rules through a structured adversarial testing process. Notably, the platform generates three essential artifacts: the Sigma rule itself, a detailed threat report documenting the validation process, and a proof bundle that assesses the rule’s performance against known threats, benign instances, and adversarial attempts to bypass the detection. This advancement holds significant implications for the AI/ML security community by streamlining the traditionally complex and time-consuming process of threat detection rule development. By utilizing four specialized LLM agents—each playing a distinct role in the detection ecosystem—Doc-foundry facilitates the detection team's ability to iteratively harden rules against specific adversarial attacks. Unlike existing solutions that merely generate rules, this framework insists on producing verifiable evidence of the rule's effectiveness against both real threats and potential evasion techniques. Such a deterministic and reproducible approach sets a new benchmark in security detection, ultimately enhancing the efficacy and reliability of cybersecurity measures.