Getting mitre techniques a customer raw detection rule covers
So our team is trying to build a dashboard where we show how well a customer detection rules covers the 216 mitre techniques , so for each individual rule we reflect which technique this particular rule covers . But we get raw rule from the customer connector…
So our team is trying to build a dashboard where we show how well a customer detection rules covers the 216 mitre techniques , so for each individual rule we reflect which technique this particular rule covers . But we get raw rule from the customer connector and to extract the mitre techniques associated with that rule we do manual searching using regex , tags etc . So if the manual search fail we make llm api call , but lately this has been costing us a lot. So I have wanted to ask is there some proven way or algo which is available or can be used to extract which mitre techniques a rule cover if there is no proper metadata or tagging. Please reply as it is of utmost need!!!
已收录讨论
Store the results???? If you're using an LLM to classify a detection's mitre tactic and technique then you can just store the result and you only pay for the classification once. This is the most basic system design problem. If you can't figure this out on you're own you're probably ngmi and I don't know how you're going to be able to even effectively use what this dashboard says.
Thanku for the reply I am a newbie just starting in tech , somehow i got the the idea of caching the results but I wanted to know people opinion that we can eliminate llm from this workflow entirely
That's fair. If you don't want to use the LLM you can classify them all by hand and keep track of them all somewhere. The major LLMs do a good job at this kind of task though