Reproduce “ARuleCon: Agentic Security Rule Conversion” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Ming Xu, Hongtai Wang, Yanpei Guo, Zhengmin Yu, Weili Han, Hoon Wei Lim, Jin Song Dong, Jiaheng Zhang
ARuleCon converts SIEM detection rules across vendors by representing source logic in a vendor-neutral intermediate representation, retrieving target-vendor documentation, and checking rule behavior with Python on synthesized logs. Across five SIEMs, GPT-5’s Splunk-to-Microsoft Sentinel logic-slot consistency score was 73.2, versus 67.6 for direct LLM translation. The check does not test native engines or production traffic.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.