Utilizing Generative AI and LLMs to Automate Detection Writing | by Dylan | May, 2024 | Medium

In Security Operations, we are primarily responsible for two things: Detection & Response. Writing detections can be a very laborious and painful process. This may be something you do when you have time outside alert triage or you may even be part of a dedicated detection engineering team. I wanted to see if I could build a solution to eliminate the toil involved in detection engineering. This is the process of going from a threat idea to a finished detection or analytic. This includes starting with an idea that represents threat behavior, researching & understanding various log sources, writing search queries in different languages, writing detection logic in different languages, and maybe even testing the detection when you’re done. This whole process is manual, time-consuming, complex, and requires expertise in multiple areas. Lets see if we can take the steps involved in this process and use generative AI or Large Language Models (LLMs) to help us do it. That way, cyber security pr

In Security Operations, we are primarily responsible for two things: Detection & Response. Writing detections can be a very laborious and painful process. This may be something you do when you have time outside alert triage or you may even be part of a dedicated detection engineering team. I wanted to see if I could build a solution to eliminate the toil involved in detection engineering. This is the process of going from a threat idea to a finished detection or analytic. This includes starting with an idea that represents threat behavior, researching & understanding various log sources, writi