Umar Shoaib

Quiet or Blind? Measuring the Cost of Exclusions in LLM-Generated Detection Rules

A detection rule costs its operator twice, in analyst time for every benign alert it raises and in dwell time for every attack it misses, and the exclusion clause that encodes what is normal in one environment decides both. Language models now write such rules from threat reports...