arXiv: From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation

This publication introduces a novel method for automating the creation of Sigma detection rules, which are used in security information and event management systems to identify cyber threats. The approach combines threat intelligence reports with a knowledge-driven enrichment process and template-based rule grounding, effectively translating narrative threat descriptions into machine-readable detection logic. This reduces the manual effort and expertise required to convert raw intelligence into actionable security alerts, addressing a common bottleneck in threat detection operations.

The primary audience is security operations and compliance teams within financial services, critical infrastructure, healthcare, and any EU-regulated entity subject to NIS2, DORA, or GDPR technical security requirements. While not a regulatory mandate itself, the paper signals a shift toward automated, intelligence-driven detection that regulators may increasingly expect as part of "state-of-the-art" security measures. Organizations relying on manual rule creation will face higher operational risk and potential audit findings if they lag behind these capabilities.

Compliance teams should monitor this development as a benchmark for their detection engineering maturity. Next steps include assessing current Sigma rule generation workflows, evaluating whether threat intelligence feeds are being systematically converted into detection content, and piloting automated rule generation tools to reduce false negatives. Additionally, document how your organization addresses the human oversight of automated rules, as accountability and validation remain core expectations under EU regulatory frameworks.