Doc-foundry: AI generates and validates detection rules
Understand this story
Developer manish121 released Doc-foundry, a multi-agent detection engineering pipeline built with LangGraph, Pydantic, FastMCP and Claude: it converts threat text such as CVEs and CISA KEV entries into Sigma detection rules, then validates whether the rules work through a Blue-vs-Red adversarial loop. The pipeline runs in two modes: LIVE mode can process arbitrary threat text, with real models writing the rules, and requires configuring GEMINI_API_KEY or ANTHROPIC_API_KEY; CANNED mode uses fixed scenarios, is fully offline and requires no keys, and the test suite runs in this mode. Deployment includes a human approval step: after running python src/run.py --approve alice to approve, the controlled deployment will succeed; deploy_detection rejects any approval token not bound to the exact bundle hash.
AI overview based on source reports · Updated 14 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIDoc-foundry – AI writes Security detection rules, then proves they work
Doc-foundry is an adversarial multi-agent detection-engineering workflow (LangGraph, Pydantic, FastMCP, Claude) that turns a threat such as a CVE, CISA KEV entry, incident writeup or ATT&CK technique into a validated first-version Sigma detection rule, a threat report with round-by-round convergence history, and a proof bundle containing a positive corpus, benign baseline, adversarial mutation set and a computed coverage label (real-coverage/brittle/broken) with FP/FN numbers and a reproducibility hash. Four LLM agents (Threat Analyst, Blue Detection Engineer, Telemetry, Red-Team Adversary) propose, while a deterministic referee handles FP/FN evaluation, adversarial evasion, the coverage verdict, red-team verification and the deployment gate, so the same input yields the same verdict and hash. A second pipeline, the Review Chain, runs draft → Red Team → revision → SOC Lead → final rule and produces a reviewed but explicitly unvalidated rule with the full trail of findings that shaped it.
Activity for this story
- Current comparable activity
- 7
- Peak comparable activity
- 10Nov 14 08:00
- Change in the past 24 hours
- –
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.