# REPRESENTATIVE OUTPUT — authored at M8 build time; REGENERATE on the golden VM:
#   docker compose run --rm runner python app/detection_eng.py | tee expected/detection_eng_output.txt
────────────── Day 4 — Detection Engineering: Generate → Validate → Repair ──────────────

  Model: qwen2.5:3b staged and ready.
  Running full generate → validate → repair loop.

──────────────── Exercise A: Sigma Rules — Generate → Validate → Repair ────────────────

  Model: qwen2.5:3b  |  Incidents: 3  |  Max repair attempts: 2

─────────────────────────────────── Incident 1/3 ───────────────────────────────────
╭─ Incident 1 ────────────────────────────────────────────────────────────────╮
│ The web team reported a spike in failed logins on the customer portal…      │
╰─────────────────────────────────────────────────────────────────────────────╯

Generating Sigma rule…
  (312 tokens, 3.4 tok/s)

Generated rule:
  1 title: Credential Stuffing Against Web Login Endpoint
  2 id: 7c2d4e8a-1f3b-4a6c-9d0e-5b8f2a4c6e1d
  3 status: experimental
  4 description: Detects a high volume of failed POST logins followed by a success
  5 logsource:
  6     category: webserver
  7     product: apache
  8 detection:
  9     selection_failed:
 10         cs-method: POST
 11         cs-uri-stem|contains: '/account/login'
 12         sc-status: 401
 13     condition: selection_failed | count() > 100
 14 falsepositives:
 15     - Password manager retry storms
 16     - Load tests against the login endpoint
 17 level: high
Validating (Sigma)…
  validation: PASS
╭─ Sigma validator output ────────────────────────────────────────────────────╮
│ === Summary ===                                                             │
│ Found 0 errors, 0 condition errors and 0 issues.                            │
│ No rule errors found.                                                       │
╰─────────────────────────────────────────────────────────────────────────────╯

  Final: VALIDATED

[… Incident 2/3 and 3/3 follow the same shape; Incident 2 typically needs one
   repair when the model omits the id field — the repair attempt shows the
   sigma check error being fed back and a corrected rule passing …]

──── Exercise B: Suricata Rules — Generate → Validate (suricata -T) → Repair ────

suricata -T = config/rule self-test only. No live capture, no -i, no pcap
reading anywhere in this lab (ADR-5).

  Model: qwen2.5:3b  |  Scenarios: 2  |  Max repair attempts: 2

─────────────────────────────────── Scenario 1/2 ───────────────────────────────────
Generating Suricata rule…
  (96 tokens, 3.1 tok/s)

Generated rule:
  1 alert http any any -> any any (msg:"POLICY Executable file download over HTTP"; flow:established,to_server; http.uri; content:".exe"; nocase; endswith; classtype:policy-violation; sid:9000101; rev:1;)
Validating (Suricata)…
  validation: PASS
╭─ Suricata validator output ─────────────────────────────────────────────────╮
│ Notice: suricata: This is Suricata version 7.0.2 RELEASE running in SYSTEM  │
│ mode                                                                        │
│ Notice: suricata: Configuration provided was successfully loaded. Exiting.  │
╰─────────────────────────────────────────────────────────────────────────────╯

  Final: VALIDATED

[… Scenario 2/2 follows the same shape with the python-requests User-Agent rule …]

──────────────────────────────── Exercise complete ────────────────────────────────

        Generate → Validate → Repair Summary
┌──────────────────┬──────────────┬──────────────┬───────────┐
│ Exercise         │ Item         │ Repairs used │ Result    │
├──────────────────┼──────────────┼──────────────┼───────────┤
│ Sigma            │ Incident 1   │      0       │ VALIDATED │
│ Sigma            │ Incident 2   │      1       │ VALIDATED │
│ Sigma            │ Incident 3   │      0       │ VALIDATED │
│ Suricata         │ Scenario 1   │      0       │ VALIDATED │
│ Suricata         │ Scenario 2   │      0       │ VALIDATED │
└──────────────────┴──────────────┴──────────────┴───────────┘

SecAI+ domain D3 coverage:
  - The generate → validate → repair loop is THE core AI detection-engineering pattern
  - Static validators (sigma-cli, suricata -T) gate LLM output before a human reviews it
  - Validator error text is high-quality repair context — feed it back verbatim
  - A validated rule is still a DRAFT: a human reviews logic before deployment
  - Offline design: bundled incidents, no live capture, no internet at demo time (ADR-5)
