Hisham Tariq

Quiet or Blind? Measuring the Cost of Exclusions in LLM-Generated Detection Rules

A detection rule costs its operator twice, in analyst time for every benign alert it raises and in dwell time for every attack it misses, and the exclusion clause that encodes what is normal in one environment decides both. Language models now write such rules from threat reports...

What Does a Missing Exclusion Clause Cost? Measuring the False-Positive Burden of LLM-Generated Detection Rules

Large language models now write detection rules, and the work evaluating them asks whether the rules catch attacks. It does not ask what they cost on a quiet day. That cost sits in the exclusion clause the "alert when X, except when Y" half of a rule, which encodes local knowledg...