Step 1 – Identify the suspicious Pattern

Imagine you notice the following SSH authentication events in a test environment:

Failed password for user admin from 203.0.113.50
Failed password for user admin from 203.0.113.50
Failed password for user admin from 203.0.113.50
Accepted password for user admin from 203.0.113.50

The interesting pattern is:

Multiple failed logins → Successful login → Same source IP

Instead of manually figuring out how to represent this detection, ask AI for help.

Step 2 – Ask AI to create a Sigma Rule

Use a prompt like:

I'm creating a Sigma detection rule for an authorized security lab.

Analyze this authentication pattern:

Multiple failed SSH login attempts followed by a successful login
from the same source IP.

Create a Sigma rule that can help detect this behavior.

Use standard Sigma fields where possible.
Explain the detection logic and identify any assumptions.

AI can generate a starting point for the rule.

For example:

title: Multiple SSH Failures Followed By Success
status: test
description: Detects suspicious authentication activity involving repeated failures and a subsequent successful login.
logsource:
  category: authentication

detection:
  failed:
    action: 'failure'
    service: 'sshd'

  success:
    action: 'success'
    service: 'sshd'

  condition: failed and success

level: medium

The exact fields will depend on your logging format and SIEM.

Step 3 – Give AI your real Log format

Generic Sigma rules often need customization.

For example, tell AI:

Our authentication logs use these fields:

source_ip
username
action
service

"action" can be either "failure" or "success".

Modify the Sigma rule to use these fields.
Explain each change.

Now the generated rule has much more useful context.

Step 4 – Ask AI to Check for False Positives

This is an important step.

Ask:

Review this Sigma rule for false positives.

What legitimate situations could trigger it?
How could I make the detection more specific without missing suspicious activity?

For example, repeated failed logins followed by success could simply be someone entering the wrong password several times.

AI can help you identify additional fields that could improve the detection, such as:

• source IP
• username
• authentication method
• destination host
• time window
• number of failures

Step 5 – Test the Detection

Before deploying the rule, test it against sample logs.

You want to verify both:

Suspicious event → Detection triggers
Normal event     → Detection does not trigger

If the rule generates too many alerts, give the results back to AI and ask it to help tune the logic.

The Workflow

The complete process looks like this:

Suspicious Logs
      ↓
Identify Pattern
      ↓
Ask AI for Sigma Rule
      ↓
Adapt to Your Log Format
      ↓
Review False Positives
      ↓
Test
      ↓
Deploy

Writing detection rules requires understanding both the security behavior and the log format. AI can help bridge the gap between the two.

Instead of asking:

“Write me a Sigma rule.”

Give AI the actual detection goal, sample logs, field names, and expected behavior. That produces a much more useful starting point for your detection engineering workflow.