Extractionandnarrative
Map the record to ATT&CK, IoCs and signature candidates deterministically. The prose comes last and cannot act.
Extraction is deterministic. Roughly sixty command-to-technique mapping rules turn the recorded session into an ATT&CK technique set, a list of indicators, and candidate signatures. No model is involved in any of that.
In the design there is exactly one LLM call per session, it happens after the session has ended, and its only job is to turn the finished structured record into a readable narrative. It cannot convert a session, block traffic, change a network, or promote a rule.
That boundary is a security control, not a style choice. Logs and command output are attacker-controlled text. An execution-capable model wired into the containment engine would be prompt injection with a direct path to security actions.
In this build: nine keyword rules covering six techniques, indicators kept only when they are public addresses or registrable domains, and one candidate rule per converted session. The narrative is a fixed template; the LLM call is designed, not built.
- Completed session record from L5
- ATT&CK techniques
- IoCs
- Signature candidates
- Written narrative
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
The narrative is a convenience for the human reading the case. Nothing downstream should ever depend on its wording.