⬢github Python · 3 ★ +3 since we first saw it · pushed 4 d ago · NOASSERTION
mjha-arya/DOC-foundry
Adversarial multi-agent detection engineering: Blue authors Sigma rules, Red attacks them, a deterministic referee proves coverage, and a stakeholder review chain ships the rule with its review trail.
DOC-foundry is a Python tool that turns a threat description (CVE, CISA KEV entry, ATT&CK technique) into a validated Sigma detection rule. LLM agents play adversarial roles — Blue writes rules, Red attacks them — while a deterministic referee evaluates false positives/negatives and produces a proof bundle with a computed coverage label (real-coverage/brittle/broken) and reproducibility hash. A second review-chain pipeline adds human stakeholder review before shipping the rule.
Why now: It was recently featured on Hacker News with the pitch that AI not only writes security detection rules but proves they work — an unusual 'detection-as-code' claim driving the discussion.
Who it is for: Detection engineers and security teams who author Sigma rules and want AI-assisted drafting backed by reproducible validation evidence.
detection-as-codedetection-engineeringlanggraphllm-agentsmulti-agent-systemssecurity-automationsigma-rulesthreat-detection
Stars over our 71 snapshots: 0 to 3, since 17 h ago.
Where people talked about it
API: https://socialmediatrends-api.osmike.com/v1/repos/mjha-arya/DOC-foundry