Knowledge-Graph-Constrained LLM Generation of SIEM Detection Rules

Statut : Accepté le 20 juillet 2026 à LLM4Sec @ ESORICS 2026 ; inclus dans les actes LNCS.

Période de la conférence : 2026-09. La date de cette fiche est celle de son ajout, pas celle de la parution des actes.

Contribution in brief

The study uses a knowledge graph to supply valid fields, log sources and Sigma categories to a language model that generates detection rules. It evaluates structural dimensions separately: syntax and compilation, fields, log source, ATT&CK tags and agreement with reference rules.

The revised presentation distinguishes cloud-hosted inference from the possibility of a future self-hosted deployment. It also distinguishes structural agreement from operational detection effectiveness. The reference rules share provenance with the graph and the evaluation scenarios, so agreement with those rules does not provide an independent test of generalization.

This English summary is based on the authors’ revised LLM4Sec presentation dated 14 September 2026, prepared for ESORICS on 18 September. A permanent public URL for the presentation and the artifact has not yet been verified. It should be read alongside the final proceedings version when available.

Related methodology: Benchmarking Detection Engineering Improvements through Instrumented Adversary Emulation.