ARuleCon: Agentic Security Rule Conversion
Ming Xu, Hongtai Wang, Yanpei Guo, Zhengmin Yu, Weili Han + 3 more
TLDR
ARuleCon is an agentic framework that automates the conversion of vendor-specific SIEM security rules, significantly reducing expert effort.
Key contributions
- Automates conversion of heterogeneous SIEM security rules across various vendors.
- Employs an agentic approach, removing the need for manual logic distillation or documentation.
- Integrates Python-based consistency checks by executing rules in controlled test environments.
- Achieves high fidelity, outperforming baseline LLM models by 15% in rule conversion.
Why it matters
Converting security rules across different SIEM systems is a major challenge due to vendor-specific formats and deep domain knowledge requirements. ARuleCon offers an autonomous solution, saving significant expert time and ensuring the continued utility of existing security rules in a multi-vendor environment.
Original Abstract
Security Information and Event Management (SIEM) systems make it possible for detecting intrusion anomalies in real-time manner by their applied security rules. However, the heterogeneity of vendor-specific rules (e.g., Splunk SPL, Microsoft KQL, IBM AQL, Google YARA-L, and RSA ESA) makes cross-platform rule reuse extremely difficult, requiring deep domain knowledge for reliable conversion. As a result, an autonomous and accurate rule conversion framework can significantly lead to effort savings, preserving the value of existing rules. In this paper, we propose ARuleCon, an agentic SIEM-rule conversion approach. Using ARuleCon, the security professionals do not need to distill the source rules' logic, the documentation of the target rules and ARuleCon can purposely convert to the target vendors without more intervention. To achieve this, ARuleCon is equipped with conversion/schema mismatches, and Python-based consistency check that running both source and target rules in controlled test environments to mitigate subtle semantic drifts. We present a comprehensive evaluation of ARuleCon ranging from textual alignment and the execution success, showcasing ARuleCon can convert rules with high fidelity, outperforming the baseline LLM model by 15% averagely. Finally, we perform case studies and interview with our industry collaborators in Singtel Singapore, which showcases that ARuleCon can significantly save expert's time on understanding cross-SIEM's documentation and remapping logic.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.