From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi, Mourad Debbabi, Chadi Assi
• Venue: arXiv: cs.CR
• Published: 2026-08-19
• Collected: 2026-08-20
• URL: http://arxiv.org/abs/2608.19011v1
• PDF: https://arxiv.org/pdf/2608.19011v1
• DOI: UNKNOWN
• Registry group: academic_apis_and_preprints
• Evidence role: canonical_academic_index
• Language: en
• Country / region: UNKNOWN

Plain-Language Brief

The paper presents AUTOSIGMA, a system that automates the transformation of unstructured cyber threat intelligence (CTI) reports into relevant Sigma rules for threat detection. Instead of solely relying on language models, AUTOSIGMA uses a structured knowledge base to enrich partial inputs, matches them against an existing Sigma rule repository, and then employs an LLM-as-a-Judge mechanism for validation. Evaluations show that AUTOSIGMA outperforms alternative solutions in terms of rule validity, relevancy, MITRE ATT&CK technique coverage, and robustness.

What the Document Says

• The paper introduces AUTOSIGMA, a system for converting unstructured CTI reports into relevant Sigma rules.
• AUTOSIGMA leverages a structured knowledge base to enrich partial inputs.
• It matches the enriched content against an existing Sigma rule repository.
• An LLM-as-a-Judge mechanism is used for validation.
• Evaluations show AUTOSIGMA outperforms alternative solutions in various aspects.

Key Concepts Mentioned

• cyber threat intelligence (CTI)
• Sigma rules
• automated solution
• knowledge-driven enrichment
• template-based rule grounding
• LLM-as-a-Judge mechanism

Claims Made by the Document

• AUTOSIGMA outperforms alternative solutions and LLM models in rule validity.
• AUTOSIGMA outperforms alternative solutions and LLM models in rule relevancy.
• AUTOSIGMA has better MITRE ATT&CK technique coverage than other solutions.
• AUTOSIGMA is robust against input quality issues.

Evidence Used

• Evaluations across multiple real-world APT reports and multiple security blogs

Methods / Approach

• knowledge-driven enrichment
• template-based rule grounding
• LLM-as-a-Judge mechanism

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

The system's performance might be affected by the quality and comprehensiveness of the knowledge base and Sigma rule repository.

Open Questions

• How often and how extensively is the knowledge base and Sigma rule repository updated?
• What are the specific improvements in MITRE ATT&CK technique coverage?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The paper does not provide details on how frequently or extensively the knowledge base and Sigma rule repository are updated. It also doesn't specify the exact improvements in MITRE ATT&CK technique coverage.

Raw Abstract / Excerpt

Mechanisms for dynamically converting cyber threat intelligence (CTI) into actionable detection capabilities are necessary due to the rapid evolution of Advanced Persistent Threats (APTs). Sigma rules are an essential part of contemporary threat detection workflows because they offer a platform-independent framework for expressing detection logic that can be converted into particular queries across SIEM systems. Conventional techniques for manually crafting Sigma rules are prone to mistakes, and necessitate extensive knowledge, which restricts their scalability. Although there are open-source and industry-maintained Sigma rule repositories, they often fail to keep pace with emerging threats and require frequent customization to fit diverse operational environments. This emphasizes the necessity of dynamic rule generation that is adapted to evolving attack techniques as well as particular use cases. In this work, we design AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules. Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation. Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality. AUTOSIGMA's Demo: https://youtu.be/iSr6IurQ6BM