GoKawiilDetection-as-Code Foundry pairs LLM agents with a deterministic referee to validate Sigma rules
A new multi-agent system called Detection-as-Code Foundry uses four role-specialized LLM agents—Threat Analyst, Blue Detection Engineer, Telemetry, and Red-Team Adversary—built on LangGraph, Pydantic, FastMCP and Claude to turn a threat input like a CVE or ATT&CK technique into a Sigma detection rule. The rule is run through an adversarial Blue-vs-Red loop and shipped with a proof bundle: a positive and benign test corpus, an adversarial mutation set, and a coverage label (real-coverage, brittle, or broken) with FP/FN counts and a reproducibility hash. A deterministic engine, not the LLMs, decides all pass/fail verdicts, evasion results and the deployment gate.