Threat Detection Rule Expert

What is it ?

For a security engineer, it is hard to keep learn and keep track of mulrple SIEM and firewall DSLs for writing detection rules.    In your workflow, you just want 'ask' about specific threats and advisories and let someone write detection rules for that threat 

Threat Detection Rule expert does exactly that.  We maintain knowledge of vendor DSLs and best practice rule writing guides from multiple SIEM and Firewall vendors, make it available to you at your finger tips.

Where to Access ?

Here is the link to Transilience Threat Intelligence Expert, Custom GPT

Any questions on the GPT, fee free to join our community and ask.

Features

The following vendors are supported

1. SIEMs
   1. Splunk SPL detection rules
   2. IBM QRadar and AQL rules
2. Firewalls
   1. Palo Alto Networks Firewall
   2. Cisco ASA
   3. Fortinet FortiOS
3. Cloud
   1. AWS 

Use Cases

Use Case	Prompt Example	Screenshot	Demo
Splunk: Write a detection rule in Splunk SPL	write a detection rule to detect inbound traffic from 34.4.22.456 in SPL detection language		Demo
QRadar : Detection rules in QRadar AQL	write a detection rule to detect inbound traffic from 34.4.22.456 in qradar detection language		Demo
Palo Alto:  Blocking rules in Palo Alto Firewall	write a detection rule to detect inbound traffic from 34.4.22.456 in Palo Alto Networks Firewall		Demo
Cisco ASA: Blocking rules in Cisco ASA Firewall			Demo

Release notes

Version 0.2