| license: mit | |
| language: | |
| - en | |
| tags: | |
| - cybersecurity | |
| - sigma | |
| - detection-engineering | |
| - mitre-attack | |
| - gradio | |
| - enterprise | |
| library_name: sklearn | |
| # SigmaForge Logsource Classifier | |
| TF-IDF + Logistic Regression classifier that maps detection hypotheses to Sigma `logsource` fields (product, service, category). | |
| ## Intended Use | |
| - Classify log source for Sigma rule generation pipeline | |
| - Not for production SIEM routing without retraining on your environment | |
| ## Training | |
| Trained on synthetic hypothesis ↔ logsource pairs derived from SigmaHQ rule corpus. | |
| ## Limitations | |
| - CPU-only inference | |
| - Best performance on Windows/Sysmon/DNS hypotheses | |
| - Heuristic fallback when model artifacts unavailable | |