Sigma Rule Conversion Feedback for CTI Intelligence Cycles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CTI intelligence cycles face inefficiencies due to delayed conversion processing of Sigma rules, as manual intervention is required when automatic conversion tools fail, without providing administrators with automation efficiency insights.
Innovation Solution
An information processing apparatus that presents counts of successfully and unsuccessfully converted Sigma rules, utilizing both automated tools and generative AI, along with manual conversion where necessary, and calculates an efficiency index to improve cycle efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If automatic conversion tools are used to convert Sigma rules into detection rules, then conversion speed is improved, but conversion accuracy deteriorates due to failed conversions requiring manual intervention
Solution Approach 1:
The system implements feedback by calculating and presenting an efficiency index that reflects the success rate of automatic conversion. This feedback mechanism allows administrators to monitor conversion quality and understand when manual intervention is needed, resolving the contradiction by making conversion accuracy measurable and manageable through automated metrics.
Solution Approach 2:
The efficiency index acts as an intermediary between the automatic conversion tool and the administrator. It mediates the information gap by translating complex conversion outcomes into a simple, actionable metric that indicates whether automatic conversion succeeded or if manual intervention is required, thus maintaining both speed and accuracy.
2Manufacturing precision
If manual conversion is performed by administrators, then conversion accuracy is improved, but productivity deteriorates due to time-consuming manual processes
Solution Approach 1:
The system enables self-service by automatically calculating and presenting the efficiency index, allowing administrators to make informed decisions about when to intervene manually versus when to rely on automatic conversion. This reduces unnecessary manual work while maintaining accuracy, thus improving productivity without sacrificing conversion quality.
Solution Approach 2:
Instead of requiring administrators to manually convert all rules, the system applies partial action by only requiring manual intervention when the efficiency index indicates conversion failures. This selective approach maintains accuracy for critical conversions while improving overall productivity by automating successful conversions.
3Stability of the object's composition
If conversion processing is performed periodically, then system stability is improved, but responsiveness to new threats deteriorates due to delays in rule updates
Solution Approach 1:
The efficiency index provides continuous feedback on conversion status, enabling the system to respond to new threats more quickly by immediately indicating when conversion is complete and ready for implementation. This maintains system stability through structured processing while improving response speed through real-time status visibility.
4Manufacturing precision
If administrators monitor conversion processes, then conversion accuracy is improved, but device complexity increases due to additional monitoring requirements
Solution Approach 1:
The efficiency index acts as a visual indicator (analogous to color changes) that immediately communicates conversion status. This simple, standardized metric reduces monitoring complexity by providing a clear, intuitive signal about conversion accuracy without requiring complex monitoring systems or administrative overhead.
Data Source
AI summary
An information processing apparatus presents a count of rules for which conversion processing by a tool is successful and a count of rules for which the conversion processing fails, the conversion processing being for converting rules written in a specific format that are for detecting a cyberattack into a format implementable in a system.