Doc-foundry – AI writes Security detection rules, then proves they work

What happened

DOC‑foundry is a workflow that lets AI write Sigma detection rules and then prove they work. Four LLM agents—Threat Analyst, Blue Detection Engineer, Telemetry, and Red‑Team Adversary—create a rule, attack it, and a deterministic referee evaluates coverage, false positives, and false negatives. The process outputs a rule, a threat report with convergence history, and a proof bundle that shows the rule fires on real attacks, stays silent on benign data, and survives repeated adversarial attempts. The system also records a review chain of notes from draft to final rule.