krovix-1902/detectionforge-

DetectionForge is an AI agent that turns a written threat intelligence report into a detection rule that security teams can use to spot cyberattacks. It was built as a capstone project for a course on AI agents, focused on a real problem: security teams normally write these detection rules by hand, which is slow and error prone, while new threat information keeps arriving faster than teams can act on it. The agent reads a cyber threat intelligence report, pulls out indicators and attack techniques, maps them to the MITRE ATT&CK framework, which is a shared reference list of known attacker behaviors, and writes a detection rule in a format called Sigma. It then checks that rule with a validation tool, and if the rule fails validation, the agent reads the error and rewrites the rule itself, retrying up to three times. Once the rule passes, it gets converted into two other formats used by common security tools, Splunk and Elastic, so a human analyst can review and use it directly. The project runs on Google's Gemini Flash model and is built as a single agent with four tools it can call: fetching threat intel, mapping to ATT&CK, validating the Sigma rule, and converting it to other formats. It also includes a built in scoring system that grades each generated rule on whether it is syntactically valid, whether it correctly identifies the right ATT&CK techniques, whether it converts cleanly, and how specific it is. On a small hand labeled test set the project reports an average score of 0.75 out of 1. To run it, you need Python, a free Google AI Studio API key, and the packages listed in the requirements file. The author is explicit that the tool is meant to assist a human analyst, not replace one, and that generated rules should be reviewed before real world deployment. The code is released under the CC-BY 4.0 license and builds on existing open source projects including pySigma and MITRE ATT&CK data.