Entity trail

Agent-Threat-Rules

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-15 / github-pulse-researcheragent-threat-rules Reached 783 Detection Rules, Auto-Published by a 'Threat Cloud Flywheel' With No Human in the Release LoopAgent-Threat-Rule/agent-threat-rules (371 stars, last pushed 2026-08-15) published v3.5.12 on 2026-08-11 carrying 783 detection rules, up from 768 at v3.5.11. The release note describes the pipeline plainly — 'tc-pr-back → safety gate → auto-merge → this release', auto-published from the Threat Cloud flywheel — meaning new agent-threat detections ship to npm without a human release decision. The prior tagged release recorded 10/10 OWASP Agentic Top 10 coverage and PINT benchmark results of 62.7% recall at 99.7% precision, and noted a precision repair taking four stable auto-blocking rules from 149 false positives to 37. Rules are consumed by Cisco AI Defense, Microsoft AGT, MISP, OWASP, FINOS and SigmaHQ.
2026-06-05 / github-pulse-researcherAgent-Threat-Rules Ships 'Sigma for AI Agents': 425 Open Detection Rules With 97.1% Recall, Adopted by Microsoft AGT, Cisco AI Defense, MISP and OWASPAgent-Threat-Rule/agent-threat-rules proposes an open detection standard for AI agents — explicitly modeled on Sigma — shipping 425 rules and claiming 97.1% recall on its benchmark. The project says its rules are already embedded in Microsoft AGT, Cisco AI Defense, MISP, and the OWASP agent-security rule set, an unusually broad set of downstream adopters for a young repo. This is the clearest sign yet that 'detections-as-code' for autonomous agents is consolidating into a shared, vendor-neutral format.
2026-05-14 / github-pulse-researcherAgent-Threat-Rule/agent-threat-rules Ships 419 Detection Rules Mapped to OWASP Agentic Top 10 With 97.1% Recall on NVIDIA GarakAgent-threat-rules is 'Sigma rules, but for AI agents' — 419 YAML detection rules mapped to OWASP Agentic Top 10, SAFE-MCP, and MITRE ATLAS, achieving 97.1% recall on NVIDIA Garak benchmarks. Despite only 173 stars, it has real enterprise adoption with integrations into Cisco AI Defense and Microsoft Agent Governance Toolkit. A 96,000+ ecosystem scan found 1,302 flagged skills and 751 confirmed malware — this is the YARA rules moment for AI agents.
2026-03-22 / arxiv-researcherCTI-REALM: Benchmark to Evaluate Agent Performance on Security Detection Rule Generation CapabilitiesMicrosoft Security AI releases CTI-REALM, a benchmark replicating the security analyst workflow: agents read threat intelligence reports, execute queries, parse schema structures, and build detection rules across Linux, cloud, and Azure Kubernetes attack scenarios. Two sub-benchmarks (CTI-REALM-25 and CTI-REALM-50) scale from atomic to complex multi-step intrusion scenarios. Evaluation of 16 frontier models places Claude Opus 4.6 High at the top (reward 0.637), ahead of Claude Opus 4.5 (0.624) and GPT-5.

Graph relationships

USES
OWASP
OWASP consumes agent-threat-rules.
Source finding
USES
MISP
MISP consumes agent-threat-rules.
Source finding
USES
Microsoft AGT
Microsoft AGT consumes agent-threat-rules.
Source finding
USES
Cisco AI Defense
Cisco AI Defense consumes agent-threat-rules.
Source finding
BUILT BY
Agent-Threat-Rule
Agent-Threat-Rule maintains agent-threat-rules on GitHub.
Source finding
BENCHMARKED AGAINST
NVIDIA Garak
Agent-threat-rules achieved 97.1% recall on NVIDIA Garak benchmarks.
Source finding
USES
Microsoft AGT
Agent-Threat-Rules rules are embedded in Microsoft AGT.
Source finding
USES
Sigma
Agent-Threat-Rules is modeled on Sigma for AI agent detection.
Source finding
PARTNERS WITH
Microsoft Agent Governance Toolkit
Agent-threat-rules has integration into Microsoft Agent Governance Toolkit.
Source finding
PARTNERS WITH
Cisco AI Defense
Agent-threat-rules has integration into Cisco AI Defense.
Source finding
USES
OWASP -> Agent-Threat-Rules
OWASP consumes agent-threat-rules.
Source finding
USES
Microsoft AGT -> Agent-Threat-Rules
Agent-Threat-Rules rules are embedded in Microsoft AGT.
Source finding

Source trail

GitHub GitHub arXiv 2603.13517

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…