Sigma detection rule writing, validation, and conversion for SOC analysts and threat-intel teams.
LLM-assisted draft + pySigma validation + multi-backend conversion (Splunk, Elastic, OpenSearch; Wazuh through the Elastic Lucene backend) with logsource-aware processing pipelines. Ships a 294-rule published corpus spanning 16 categories (every MITRE ATT&CK Enterprise tactic plus code review), covering ransomware and threat-actor activity as well as vulnerabilities disclosed in AI/LLM applications
3 in the Claude listing