ZERO-RULES Alert Contextualizer & Correlator

The talk starts from the problem that multi-stage intrusions are split across many alerts and log sources, while analysts still depend on playbooks, lookups and individual judgment. Correlation rules are costly to maintain, and ATT&CK technique tags on detection content are inconsistent because they were written by many authors for different purposes.

The speaker proposes a pipeline. A language model, configured for low randomness so its output is repeatable, assigns one ATT&CK technique to each unique alert description, producing a consistent mapping that can be attached to events in the SIEM. Entity attributes such as business unit, owner or patch date are added alongside. Events are then clustered by similarity with simple methods such as DBSCAN or k-means, using a graph structure to encode domain knowledge like related ports, subnets or sub-organizations. Clusters are chained with a Markov-style state model to approximate attack flows. Tests on a few thousand alerts produced clusters the team found worth investigating, although the reference labels used for evaluation were themselves incomplete.

The main takeaways are to start with a simple, explainable model rather than a black-box language model for correlation, and to use language models mainly for one-time enrichment. Where historical tickets can be trusted, a supervised classifier can show analysts past relevant cases. The speaker also suggested measuring analysts by their contributions to detections and playbooks rather than only by time to close.