A multi-stage LLM agent pipeline (RAM) maps structured SIEM rules to MITRE ATT&CK techniques, achieving AR 0.75 and AP 0.52 with GPT-4-Turbo on recent Splunk rules.
Title resolution pending
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
fields
cs.CR 1years
2025 1verdicts
CONDITIONAL 1representative citing papers
citing papers explorer
-
Rule-ATT&CK Mapper (RAM): Mapping SIEM Rules to TTPs Using LLMs
A multi-stage LLM agent pipeline (RAM) maps structured SIEM rules to MITRE ATT&CK techniques, achieving AR 0.75 and AP 0.52 with GPT-4-Turbo on recent Splunk rules.