From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability
arXiv:2606.05252v1 Announce Type: cross Abstract: Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder. These Breach-and-Attack-Simulation (BAS) tools surface findings, but the security information and event management (SIEM) systems that watch production need detection rules -- and today a human bridges that gap by hand, reading each finding and writing the corresponding Sigma rule (a vendor-neutral detection format). We show this translation can be partially automated when probes are drawn from a locked corpus, so e
The increasing sophistication of cyber threats and the proliferation of security tools like Breach-and-Attack-Simulation (BAS) are driving the need for more efficient and automated detection rule generation.
Automating the translation of attack simulations into SIEM detection rules significantly reduces the manual effort and expertise required, enhancing an organization's ability to respond to cyber threats quickly and at scale.
The gap between attack simulation findings and the deployment of SIEM detection rules is being partially bridged by automation, moving towards a more 'detection-as-code' paradigm.
- · Cybersecurity teams
- · Security automation vendors
- · Organizations using BAS tools
- · Managed Security Service Providers
- · Manual security rule engineers
- · Companies relying on outdated SIEM practices
Security operations become more efficient and proactive due to faster rule deployment from attack simulations.
The cost of maintaining and updating SIEM detection rules decreases, potentially allowing smaller organizations to adopt more sophisticated security practices.
This automation could lead to a 'race to the bottom' in terms of human analyst skills for routine rule generation, shifting the focus to more complex threat hunting and incident response tasks.
This signal links to a primary source. Continuum Brief monitors and indexes it as part of the live intelligence stream — we do not republish source content.
Read at arXiv cs.AI