Doc-foundry releases adversarial multi-agent detection-engineering workflow
Start here
mjha-arya released Doc-foundry, an open-source detection-engineering workflow built on LangGraph, Pydantic, FastMCP and Claude that turns a threat such as a CVE or ATT&CK technique into a Sigma detection rule plus a proof bundle. Four LLM agents (Threat Analyst, Blue Detection Engineer, Telemetry and Red-Team Adversary) propose rules, while a deterministic referee handles false-positive/false-negative evaluation, adversarial mutation, coverage verdicts and the deployment gate, labeling each rule as real-coverage, brittle or broken and attaching a reproducibility hash. A second Review Chain pipeline runs draft, Red Team, SOC Lead and final-rule stages; the project states that this chain does not invoke the proof core and issues no coverage verdict. In LIVE mode any threat text is authored by a real model and requires a GEMINI_API_KEY or ANTHROPIC_API_KEY. CANNED mode runs a fixture scenario fully offline with no key and is what the test suite drives. There is no default scenario: the Foundry takes the threat the user supplies.
Generated from reports · updated 1 h ago
Report timeline
Follow the reports to see the event from different sides.
- Hacker News · AIDOC-foundry launches an adversarial multi-agent pipeline that writes Sigma detection rules and proves them
DOC-foundry is an open-source detection-engineering workflow built on LangGraph, Pydantic, FastMCP and Claude that turns a threat such as a CVE or ATT&CK technique into a Sigma rule plus a proof bundle. Four LLM agents (Threat Analyst, Blue Detection Engineer, Telemetry, Red-Team Adversary) propose, while a deterministic referee handles FP/FN evaluation, adversarial mutation, coverage verdicts and the deployment gate, producing a real-coverage, brittle or broken label with a reproducibility hash. A second Review Chain pipeline runs draft, Red Team, SOC Lead and final rule stages and explicitly issues no coverage verdict.
Heat for this event
Not enough continuous observations yet to draw a trend.