Abstract
Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules. General-purpose large language models (LLMs) can draft such rules, but often produce invalid YAML, incorrect log sources, unsupported fields, or overly broad detection logic. This paper presents \emph{Sigma-Hunter}, a domain-adapted LLM for analyst-assistive Sigma rule generation and threat hunting. We build an instruction-tuning dataset from 3,635 validated open-source Sigma rules, expanded into 7,663 question-answer and analyst-reasoning examples. Each source rule is assigned to a single train, validation, or test partition before this expansion, so no rule leaks across splits. We fine-tune a 7B Mistral model and a Phi-4 model with LoRA and score held-out rule generations on syntax, approximate field consistency, and a semantic judgment of detection logic, completeness, selectivity, and log-source alignment. Sigma-Hunter-Mistral scores 8.17 overall, against 7.88 for the strongest general-purpose baseline and 4.61 for untuned Mistral. Two findings stand out: domain adaptation enables a compact 7B model to perform competitively with larger general-purpose models on this structured task, and syntactic validity is a weak proxy for semantic rule quality, as several baselines emit well-formed YAML carrying weak detection logic. The adapted models run locally, which suits detection engineering in disconnected environments where analysts cannot reach hosted model services.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Davaslioglu, K., & Kompella, S. (2026). Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering. https://omanscience.com/en/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering
MLA 9
Davaslioglu, Kemal, and Sastry Kompella. "Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering." https://omanscience.com/en/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.
Chicago (author–date)
Davaslioglu, Kemal, and Sastry Kompella. 2026. "Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering." https://omanscience.com/en/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.
Harvard
Davaslioglu, K. and Kompella, S. (2026) 'Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering', Available at: https://omanscience.com/en/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.
Vancouver
Davaslioglu K, Kompella S. Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering. https://omanscience.com/en/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering
IEEE
K. Davaslioglu, and S. Kompella, "Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering," https://omanscience.com/en/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.