Accelerating detection engineering using AI-assisted synthetic attack logs generation

This Microsoft Defender Security Research blog explores using AI to generate high-fidelity synthetic security attack logs from MITRE ATT&CK TTPs to speed detection engineering and preserve privacy. It describes three approaches—prompt-engineered generation, an agentic generator/evaluator/improver workflow, and reinforcement learning with verifiable rewards—details evaluation on multiple datasets (Goal-Driven campaigns, Security Datasets Project, ATLASv2), and concludes agentic workflows and reasoning models show the best fidelity while RLVR shows promise given sufficient labeled data.