Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering
Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules. General-purpose large language models (LLMs) can draft such rules, but often produce invalid YAML, incorrect log sources, unsupported fields, or overly broad detection logic. This paper presents \...
Kemal Davaslioglu, S. Kompella
· 0 citations