Análise de regras Sigma geradas por agente autônomo com RAG

Abstract

The increasing sophistication and volume of cyber threats pressure security teams to reduce the interval between the disclosure of a vulnerability and the availability of the corresponding detection. Sigma rules constitute an open standard for describing detection logic in Security Information and Event Management (SIEM) systems, but their manual authoring is slow and prone to gaps in the face of emerging threats. This work develops and evaluates an autonomous agent for the automated generation of Sigma rules from diverse threat intelligence sources, with the purpose of supporting the security analyst, who remains responsible for the final validation. The agent is implemented as a graph-oriented state machine that integrates retrieval-augmented generation (RAG) over a reference rule repository, rule generation by a large language model (LLM), and iterative validation of the output. Its effectiveness is assessed by comparison with expert-written reference rules and with intermediate approaches. The results support the feasibility of the agent exclusively as a supporting tool for the specialist. However, the observed performance does not surpass that of commercial LLMs used directly, evidencing that the proposed architecture, in isolation, is not yet competitive for autonomous use.