Extractionandnarrative
Map the record to ATT&CK, IoCs and signature candidates deterministically, then make exactly one LLM call for the prose.
Extraction is deterministic. Roughly sixty command-to-technique mapping rules turn the recorded session into an ATT&CK technique set, a list of indicators, and candidate signatures. No model is involved in any of that.
There is exactly one LLM call per session, it happens after the session has ended, and its only job is to turn the finished structured record into a readable narrative. It cannot convert a session, block traffic, change a network, or promote a rule.
That boundary is a security control, not a style choice. Logs and command output are attacker-controlled text. An execution-capable model wired into the containment engine would be prompt injection with a direct path to security actions.
- Completed session record from L5
- ATT&CK techniques
- IoCs
- Signature candidates
- Written narrative
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
The narrative is a convenience for the human reading the case. Nothing downstream should ever depend on its wording.