Preprint Open access
Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering
Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules. General-purpose large language models (LLMs) can draft such rules, but often produce invalid YAML, incorrect log sources, unsupported fields, or overly broad detection logic. This paper presents \ …