rfc: classify findings and make catalog detection rules executable and testable - #23
rfc: classify findings and make catalog detection rules executable and testable#23eeee2345 wants to merge 1 commit into
Conversation
…d testable Signed-off-by: Adam Lin <eeee2345@users.noreply.github.com>
|
Strong direction. I think the reproducibility claim needs one more layer: TP/TN cases and a false-positive number are not comparable unless the catalog entry identifies the exact subject and measurement semantics. A minimal, format-neutral rule evidence envelope could declare:
Otherwise two members can run the same named rule over the same named corpus, count rule firings vs. unique inputs, collapse errors into negatives, or load different normalizers and still publish incompatible “error rates.” We hit this distinction while tightening Spectorn's multi-engine agent gateway: malformed or partially mapped action carriers initially produced plausible-looking negative results until artifact/config identity and explicit unusable states were preserved. That is local implementation and test evidence, not live-deployment evidence. This seems complementary to #9 (method declarations) and #20 (observed artifact identity). If useful, I can prepare a small DCO-signed follow-up commit adding the envelope requirement and a minimal conformance example. Disclosure: I work on Spectorn; it is cited only as an implementation case. |
|
The one-commit follow-up is now open against your branch: eeee2345#1 It is DCO-signed, cleanly mergeable, and only adds the reproducible rule-evidence envelope discussed above. |
2 participants
What this changes
Two additions to From Lessons to Controls:
Each recommendation also specifies the technique classification of the failure against open, vendor-neutral taxonomies (for example MITRE ATLAS techniques or the OWASP LLM and agentic classes). The Mission says SAFE turns recurring failures into shared controls, and the confidential rapid alert shares affected patterns. Recurrence and patterns are only mechanically detectable if findings carry a shared classification; without one, spotting the same failure twice depends on editorial memory.
The catalog paragraph already commits SAFE to publishing machine-readable policies and detection rules in a shared, versioned catalog, but says nothing about what form those rules take. The added paragraph asks published detection rules to meet the same bar the RFC already sets for recommendations (a reproducible verification method): open executable format, declared true-positive and true-negative test cases, measured false-positive evidence on benign traffic, a version, and the classification above. It names Sigma and ATR as existing examples at the infrastructure and agent layers; the normative text stays format-agnostic.
Why, argued from the RFC's own goals
A catalog entry a member can adopt and verify needs tests and stated error rates in the same way the RFC already demands a reproducible verification method for controls. And the weekly machine-readable updates in Notification Timelines only interoperate across members if the semantics of a finding (what technique class, which detection caught or missed it) are classified consistently, not only the transport format.
Relationship to open issue #5
Complementary, not overlapping. #5 proposes mapping the Evidence Preservation fields to OpenTelemetry GenAI semantic conventions, which is the transport layer of evidence. This change is about the semantics of findings and published rules. Both together make cross-member commonality analysis workable.
Disclosure
I maintain ATR (Agent Threat Rules, MIT), named once in the added text as an existing example alongside Sigma. The proposed wording does not require it or any specific format.