| --- |
| license: other |
| base_model: mlx-community/Qwen2.5-7B-Instruct-4bit |
| library_name: mlx |
| pipeline_tag: text-generation |
| tags: |
| - sigma |
| - cybersecurity |
| - detection-engineering |
| - lora |
| - defensive-security |
| --- |
| |
| > [!IMPORTANT] |
| > **Documentation-only preview:** Adapter weights are not currently available |
| > for public download. This adapter was trained using attributed SigmaHQ rules |
| > governed by DRL-1.1. Clarification has been requested from SigmaHQ concerning |
| > distribution of LoRA adapter weights. Weights will be released only after the |
| > licensing requirements are confirmed. |
|
|
|
|
| A narrow MLX LoRA adapter that converts a supplied, grounded detection |
| specification into a single Sigma-style JSON object. It is a compiler, not an |
| autonomous detection author: the caller supplies the detection logic, telemetry |
| fields, log source, ATT&CK mappings, false positives, and severity. |
|
|
| ## Model |
|
|
| - Base: `mlx-community/Qwen2.5-7B-Instruct-4bit` |
| - Adapter: LoRA over 8 transformer layers |
| - Training: 112 examples; validation: 12 examples |
| - Context used during training: 2,048 tokens |
| - Selected checkpoint: iteration 50 |
| - Development hardware: Apple M5, 16 GB unified memory |
|
|
| The adapter must be loaded with its exact base model. `adapters.safetensors` |
| alone is not a standalone model. |
|
|
| ## Installation |
|
|
| Requires Apple silicon, macOS, and Python 3.9 or newer. |
|
|
| ```bash |
| python3 -m venv .venv |
| source .venv/bin/activate |
| python3 -m pip install --upgrade pip |
| python3 -m pip install -r requirements.txt |
| ``` |
|
|
| ## Usage |
|
|
| From this release directory: |
|
|
| ```bash |
| python3 inference.py \ |
| --input example_input.json \ |
| --adapter adapter \ |
| --output generated_rule.json |
| |
| jq . generated_rule.json |
| ``` |
|
|
| The first run downloads the approximately 4.3 GB base model. The wrapper |
| accepts exactly these grounded input fields: |
|
|
| ```text |
| title, description, logsource, detection, attack_techniques, |
| false_positives, severity |
| ``` |
|
|
| It rejects invalid JSON, missing or extra input fields, and model output that |
| changes grounded content. A successful result contains only those fields plus |
| `"requires_validation": true`. |
|
|
| ## Evaluation |
|
|
| Checkpoint 50 was evaluated against rule families excluded from training. |
|
|
| | Evaluation | Base strict pass | Adapter strict pass | |
| | --- | ---: | ---: | |
| | Held-out Sigma rules (45) | 19/45 (42.2%) | 43/45 (95.6%) | |
| | Synthetic robustness cases (10) | 6/10 (60.0%) | 10/10 (100%) | |
|
|
| On the 45-rule set, the adapter achieved 100% exact detection logic and 100% |
| exact ATT&CK mapping preservation. Its two strict failures were description-text |
| normalization differences. The robustness suite included Unicode, nested |
| conditions, modifiers, null values, escaping, and instruction-like strings |
| embedded as data. |
|
|
| These are small, curated evaluations and are not evidence of general Sigma |
| generation ability. Retest after changing the base model, adapter, prompt, |
| dependency versions, or inference code. |
|
|
| ## Safety and limitations |
|
|
| - This model does not determine whether a detection is correct, useful, or |
| deployable. |
| - It must not invent telemetry fields or ATT&CK mappings; supply them upstream. |
| - Every output is marked as requiring validation. |
| - Validate rules with Sigma tooling and representative logs before deployment. |
| - Keep deterministic post-generation checks in production. Do not consume raw |
| model output directly. |
| - Inputs longer than the trained context or significantly different from the |
| training schema are out of scope. |
| - The robustness suite is useful evidence, not a security boundary. |
|
|
| ## Attribution and publication status |
|
|
| The base [Qwen2.5-7B-Instruct model](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct) |
| is published under Apache-2.0; the MLX conversion is |
| [mlx-community/Qwen2.5-7B-Instruct-4bit](https://huggingface.co/mlx-community/Qwen2.5-7B-Instruct-4bit). |
|
|
| Training examples were derived from rules in |
| [SigmaHQ/sigma](https://github.com/SigmaHQ/sigma), whose detection content is |
| published under the |
| [Detection Rule License 1.1](https://github.com/SigmaHQ/Detection-Rule-License). |
| Credit belongs to SigmaHQ and the individual rule contributors. Source rule IDs |
| and paths should remain available in dataset provenance records. |
|
|
| **License status:** publication review required. Before uploading the adapter or |
| training data, confirm the Detection Rule License attribution and distribution |
| requirements for this use, retain notices required by the base model, and choose |
| an explicit license for original wrapper code and documentation. Do not label |
| the complete release Apache-2.0 solely because the base model uses that license. |
| This note is not legal advice. |
|
|
| ## Release integrity |
|
|
| Verify packaged files from the release directory: |
|
|
| ```bash |
| shasum -a 256 -c SHA256SUMS |
| ``` |
|
|
