Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering

Key points

• Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules.1
• We build an instruction-tuning dataset from 3,635 validated open-source Sigma rules, expanded into 7,663 question-answer and analyst-reasoning examples.1
• We fine-tune a 7B Mistral model and a Phi-4 model with LoRA and score held-out rule generations on syntax, approximate field consistency, and a semantic judgment of detection logic, completeness, selectivity, and log-source alignment.1
• Two findings stand out: domain adaptation enables a compact 7B model to perform competitively with larger general-purpose models on this structured task, and syntactic validity is a weak proxy for semantic rule quality, as several baselines emit well-formed YAML carrying weak detection logic.1

Sources (1)

• [1]Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 6, 07:02 PM

  This paper presents Sigma-Hunter, a domain-adapted LLM for analyst-assistive Sigma rule generation and threat hunting.

  Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules.

Extractive summary: sentences quoted from the sources.