Prior art¶
| Existing | What it gives you | What ANVIL adds |
|---|---|---|
| Sigma + pySigma | Rule format, conversion | Local evaluation without a SIEM, benign-FP and budget gating, decay monitoring, drafting; pySigma is used for conversion and as a cross-check |
| SigmaHQ CI (evtx-sigma-checker, regression tests) | TP replay and goodlog checks for the SigmaHQ repo | The same idea as a reusable tool for your own rules and telemetry, plus budgets, validated coverage and decay analysis |
| Elastic detection-rules schema validation | Query fields validated against ECS / integration schemas | Condition-level satisfiability against the observed per-source inventory. ANVIL's own field-presence baseline (the per-field logic of schema validators, applied to the observed inventory) is what drops to 42% (simulated) and 65% (real OTRF) precision on a Sysmon removal; Elastic's validator itself was not run |
| Splunk ESCU + Atomic Red Team | Tested content for one platform | Backend-agnostic measurement; emulation output is an input, not a dependency |
| Chainsaw, Hayabusa, Zircolite | Fast Sigma hunting over EVTX | Lifecycle: gates, claimed-vs-validated coverage, decay, drafting |
| Long & Evans, Evolution of Log-Based Detection Rules in Public Repositories (arXiv 2605.05383) | Longitudinal study of 6,859 Sigma and Splunk rule histories; documents revisions caused by telemetry-source migrations (a Defender exclusion rule moving from Sysmon EventID 13 to EventID 5007) and argues their effect cannot be recovered from rule text without schema or telemetry knowledge | The missing piece that paper points at: a check of each rule against the observed per-source telemetry inventory, evaluated against replay ground truth |
| Maiorano, From Attack Simulation to SIEM Rule (arXiv 2606.05252) | Deterministic BAS-to-Sigma synthesis replayed through a live OpenSearch; reports that Lucene rejects \b anchors the pySigma backend emits |
ANVIL's OpenSearch cross-check hits the related Lucene regex gap (whole-term matching, below) |
Comparison with reference and published numbers¶
Each row states whether the comparison is like-for-like.
| reference | their result | ANVIL on the same input | like-for-like? |
|---|---|---|---|
SigmaHQ regression CI at 07ec293 (evtx-sigma-checker + SigmaHQ's json_matcher v0.0.2, run as json_checker), run 36187990502 |
all cases pass (green) | 463/463 | yes: same captures and expected counts |
| SigmaHQ goodlog CI on evtx-baseline win10, win11 and 2022 DC, non-low rules, run 36187990423 | 0 unexcused rules (green) | 8 non-low rules fire without a known-FPs.csv entry (2 medium, 6 informational) |
partly: same images and rules, but ANVIL excuses per rule id, which is more lenient than SigmaHQ's MatchString filters, so the 8 are a lower bound on rules where ANVIL fires and evtx-sigma-checker does not |
GAUNTLET v1.1.0 (sister project, tag cd41fa8), OTRF recordings detected at technique-family level |
sigma-all (SigmaHQ release package r2026-07-01, 2,519 rules): 67/98, 68.4% [58.6, 76.7]; sigma-full (adds low-level and threat-hunting rules, 2,805): 73/98, 74.5% [65.0, 82.1] | lenient column: 69/98, 70.4% [60.7, 78.5] (strict 62/98) | partly: the same 98 recordings and the same family-level match (ANVIL's lenient column), but different rule sets (release package r2026-07-01 vs repo commit 07ec293, 2,844 routable Windows rules, all levels). GAUNTLET v1.0.0 reported 67/96 (69.8%) before two AV-blocked recordings were added |
| Decay / breakage prediction for detection rules | no published benchmark found | Section 1 | n/a |
| LLM Sigma generation from CTI: AutoSigma (arXiv 2608.19011), CTI-REALM (arXiv 2603.13517) | rule validity and coverage on cloud blogs / agent tasks | drafts scored by execution on their own emulation | no: different corpora and metrics |
| AMIDES (Uetz et al., USENIX Security 2024, arXiv 2311.10197) | evasion of process-creation rules | - | no: it measures adversarial evasion, not benign volume or recall |