R-Vision has launched Detection Drift, an LLM-based tool designed to automate the migration of correlation rules between SIEM systems. The solution adapts existing detection logic from various platforms to the R-Vision SIEM format, reducing the manual workload for security analysts.
The tool automatically identifies the source syntax of rules from formats including Sigma, Splunk SPL, MaxPatrol SIEM, KQL, Elastic, QRadar, ArcSight, Chronicle, and YARA. It analyzes the detection logic and maps it to the target structure, optionally using event samples and vendor expertise for higher precision.
Detection Drift features an iterative feedback mechanism. If the built-in validator detects errors during the conversion process, the system automatically triggers a new iteration to refine the rule until it is accurate. The final responsibility for rule deployment remains with the human specialist.
The software supports both local and cloud-based AI models via OpenCode, cloud APIs, or OpenAI-compatible endpoints, allowing organizations to maintain infrastructure and security compliance. The tool is currently available as an open-source project on the GitVerse platform.
