Back Scworld

AI tool translates security rules for multiple SIEM systems | brief

Scworld • May 5, 2026

Academics have developed a new technique to make AI useful for cyber-defenders by translating rules from diverse security information and event managements (SIEMs) into a format that is easier to use across multiple systems. This aims to simplify the complex task of managing security alerts for security operations centers (SOCs), with further coverage provided by The Register.

Organizations often use multiple SIEMs, leading to complexity for SOCs. Researchers from the National University of Singapore and Fudan University have created ARuleCon, a system that translates SIEM rules between different platforms. Current SIEMs use specific schemas, making rules incompatible across systems. While some vendor tools exist, they support limited SIEMs. Manual conversion is slow and labor-intensive.

ARuleCon uses an agentic retrieval augmented generation pipeline, referencing official vendor documentation to overcome schema mismatches. It also includes a Python-based consistency check for accuracy. The tool can translate rules for SIEMs including Splunk, Microsoft Sentinel, IBM QRadar, Google Chronicle, and RSA NetWitness, offering a more accurate solution than generic LLMs. This capability can aid organizations in SIEM consolidation or migration, enabling SOCs to better detect threats and reduce alert noise.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI Tool Enhances SIEM Rule Translation Across Platforms Researchers from the National University of Singapore and Fudan University have developed ARuleCon, an AI system designed to translate security information and event management (SIEM) rules across various platforms. This tool addresses the complexities faced by security operations centers (SOCs) that use multiple SIEM systems, which often have incompatible schemas. ARuleCon improves translation accuracy by 10% to 15% compared to existing large language model approaches. The system utilizes an agentic retrieval augmented generation pipeline and includes a Python-based consistency check for accuracy. It supports major SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, and Google Chronicle. The manual conversion of rules is slow and labor-intensive, making this tool a significant advancement for organizations managing hybrid cloud environments and multi-vendor security stacks. While some experts believe the issue can be resolved through traditional engineering methods, others argue that AI is necessary for preserving detection fidelity during translations. 2 sources 25

Extracted Entities

Platforms (5)

Google Chronicle IBM QRadar Microsoft Sentinel RSA NetWitness Splunk