[!IMPORTANT]
Documentation-only preview: Adapter weights are not currently available
for public download. This adapter was trained using attributed SigmaHQ rules
governed by DRL-1.1. Clarification has been requested from SigmaHQ concerning
distribution of LoRA adapter weights. Weights will be released only after the
licensing requirements are confirmed.
A narrow MLX LoRA adapter that converts a supplied, grounded detection
specification into a single Sigma-style JSON object. It is a compiler, not an
autonomous detection author: the caller supplies the detection logic, telemetry
fields, log source, ATT&CK mappings, false positives, and severity.
Model
Base: mlx-community/Qwen2.5-7B-Instruct-4bit
Adapter: LoRA over 8 transformer layers
Training: 112 examples; validation: 12 examples
Context used during training: 2,048 tokens
Selected checkpoint: iteration 50
Development hardware: Apple M5, 16 GB unified memory
The adapter must be loaded with its exact base model. adapters.safetensors
alone is not a standalone model.
Installation
Requires Apple silicon, macOS, and Python 3.9 or newer.
It rejects invalid JSON, missing or extra input fields, and model output that
changes grounded content. A successful result contains only those fields plus
"requires_validation": true.
Evaluation
Checkpoint 50 was evaluated against rule families excluded from training.
Evaluation
Base strict pass
Adapter strict pass
Held-out Sigma rules (45)
19/45 (42.2%)
43/45 (95.6%)
Synthetic robustness cases (10)
6/10 (60.0%)
10/10 (100%)
On the 45-rule set, the adapter achieved 100% exact detection logic and 100%
exact ATT&CK mapping preservation. Its two strict failures were description-text
normalization differences. The robustness suite included Unicode, nested
conditions, modifiers, null values, escaping, and instruction-like strings
embedded as data.
These are small, curated evaluations and are not evidence of general Sigma
generation ability. Retest after changing the base model, adapter, prompt,
dependency versions, or inference code.
Safety and limitations
This model does not determine whether a detection is correct, useful, or
deployable.
It must not invent telemetry fields or ATT&CK mappings; supply them upstream.
Every output is marked as requiring validation.
Validate rules with Sigma tooling and representative logs before deployment.
Keep deterministic post-generation checks in production. Do not consume raw
model output directly.
Inputs longer than the trained context or significantly different from the
training schema are out of scope.
The robustness suite is useful evidence, not a security boundary.
Training examples were derived from rules in
SigmaHQ/sigma, whose detection content is
published under the
Detection Rule License 1.1.
Credit belongs to SigmaHQ and the individual rule contributors. Source rule IDs
and paths should remain available in dataset provenance records.
License status: publication review required. Before uploading the adapter or
training data, confirm the Detection Rule License attribution and distribution
requirements for this use, retain notices required by the base model, and choose
an explicit license for original wrapper code and documentation. Do not label
the complete release Apache-2.0 solely because the base model uses that license.
This note is not legal advice.
