Use case · Blue team

Turn the log pile
into detections.

Detection engineering is defense, but rule-writing for tool-shaped traffic still trips mainstream filters. HacxGPT turns raw logs and fresh advisories into tuned, documented detections.

The refusal tax

What mainstream models
do instead.

✗

Rules refused mid-task

Filters treat attack-shaped log evidence as instructions and decline to draft the detection around it.

✗

Advisory backlog

A fresh CVE is an alert queue within hours; hand-writing a rule for every advisory doesn't scale.

✗

False-positive burden

Untuned rules flood the queue, and seniors spend their week reviewing noise the pipeline should filter itself.

How teams run it here

From logs
to detections.

Log triage

Raw auth, audit, and Zeek logs clustered into behavior patterns with counts and a verdict per cluster.

Sigma authoring

Detection logic written in Sigma with field mappings, rationale, and ATT&CK references.

Advisory-to-rule

Drop in a fresh advisory; get exploitation preconditions plus a candidate detection.

Tuning & regression

Baseline notes per environment plus a regression set so updates don't break your rules.

request · shared prompt

Three days of Kubernetes audit logs, 2GB. Find the privilege-escalation attempt our alerts missed and write detections for it.

✓ hacxgptresponded

Found it: pods/exec into kube-system at 03:14 UTC following an RBAC role lookup. SIGMA - detection: selection: verb: create objectRef.subresource: pods/exec requestObject.namespace: kube-system condition: selection | count() by user > 3 + tuning notes: exclude the CI service account

✗ other llmsdeclined

~~I can't help analyze logs to find privilege-escalation activity, as the resulting rules could aid attackers.~~

Illustrative transcripts - representative answers, not captured requests.

The artifact

A rule you'd
actually ship.

iam-trust-drift.yml

title: IAM Trust Policy Modified by Rare Principal
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: UpdateAssumeRolePolicy
  filter:
    userIdentity.sessionContext: ci-runner
  condition: selection and not filter
tuning: baseline per-account admins before deploy

Every rule ships with a baseline note and a filter for your own service accounts - so it fires on attackers, not on Tuesday's deploy.

Rules come as Sigma, translate to your SIEM, and include the ATT&CK reference and a regression case so updates don't silently break them.

Model fit