CTI-REALM: A new benchmark for end-to-end detection rule generation with AI agents
ID: f4e8940f-3db0-599e-8986-7f76b78898f7
STIX ID: report--f4e8940f-3db0-599e-8986-7f76b78898f7
Feed Name: Microsoft Security
CTI-REALM is an open-source Microsoft benchmark that measures AI agents’ ability to operationalize threat intelligence into validated detections by reading CTI reports, exploring telemetry, iterating KQL queries, and producing Sigma/KQL rules across Linux, AKS, and Azure cloud environments; the paper details dataset curation, checkpoint-based scoring, evaluation of multiple model configurations, key findings, and how the community can contribute.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.