I'm replacing myself.. at least the boring parts
Source Reddit Cybersecurity
Discussion
This is a post linking to an open-source project called Actioner, which automates threat intelligence research and detection engineering tasks. The tool generates and validates detection rules (Sigma, YARA, Suricata, Snort) based on threat advisories and PoCs, aiming to reduce manual effort and improve accuracy in threat detection. There is no indication of a vulnerability or security threat in the content. The project is a utility to assist security professionals, not a malicious or exploitable component.
r/cybersecurity (opens in a new tab)u/StePidiSteP210 points0 comments
Full automated threat intel report with mitre attack mapped detections that are checked for convertibility and syntax!
Sigma/Yara/Suricata (snort). Adding KQL later as well.
The rules are by default very focused on the advisory/PoC so no more generic TTP detections.
I'm very certain this will help accelerate a lot of boring TI work and reduce hallucinations/ dumb sigma detections from vanilla LLM prompts.
Let me know how good(or shit) it is!