Add detection playbook export (STIX / Sigma) for controls → detection rule synthesis

[github-actions]

Motivation

RDX targets Managed Detection & Response and detection engineering use cases (RDX-072, RDX-073, RDX-074). Currently RDX models controls and treatment decisions but lacks a standardized format for exporting operational detection artefacts (playbooks, SIEM rules) that defenders can ingest. Mapping attackPaths and controls to STIX playbooks and Sigma rules (or references to them) will accelerate detection engineering, automate the synthesis of starter detection rules from TARA, and improve MDR interoperability.

This proposal complements the existing monitoring/detection requirement (RDX-055) by defining a concrete, machine-readable export model and export examples.

Proposed change

1. Add an optional top-level playbooks[] array under riskSet with schema fields:

   • id, title, description
   • relatedRiskValueId[] (link to riskValues)
   • relatedAttackPathIds[]
   • controls[] (control ids applied)
   • detectionArtifacts[] — array of objects with: artifactType (enum: "sigma","stix","cacao","other"), artifactRef (URI or embedded text), artifactLanguage (e.g., "sigma", "stix2.1"), mapping (array mapping attackPath step ids to lines/conditions in the artifact), confidence and author.
   • automationHints[] — structured guidance for automated translation (e.g., log sources, field mappings, sample event snippets)
   • owner / contact

2. Define export tooling guidance and an example exporter tools/rdx_to_detection.py that:

   • walks selected attackPaths + controls and emits a starter Sigma rule template(s) with references back to the originating RDX objects (attackPath IDs, riskValueId) and suggested logsource metadata.
   • optionally produces a STIX 2.1 bundle linking indicators, course-of-action (playbook), and observed-data placeholders.

3. Provide example examples/rdx-playbook-export.json and examples/rdx-playbook-sigma.yml illustrating (a) mapping of an attackPath step to a Sigma rule, and (b) a STIX bundle with course-of-action and attack-pattern links.

4. Document a recommended minimal mapping format used by exporters so that generated Sigma rules include a back-reference tag (e.g., tags: ["rdx:attackPath:AP-001","rdx:riskValue:RV-123"]) to enable traceability and CI gating.

5. New requirement id (to add to REQUIREMENTS.md):

   • RDX-116 (new requirement): "Provide a standardized detection playbook/export model enabling export of detection artifacts (Sigma, STIX) with bidirectional traceability to RDX attackPaths, controls, and risk values."

References

• STIX 2.1 (OASIS). https://www.oasis-open.org/standards#stix
• Sigma rule specification (SigmaHQ). https://github.com/SigmaHQ/sigma-specification
• Research: Detection-as-Code synthesis and deterministic Sigma generation from attack simulation (recent literature showing automated synthesis approaches). https://arxiv.org/abs/2606.05252

Acceptance criteria

• Schema additions: spec/json/rdx.schema.json and spec/xml/rdx.xsd accept a playbooks[] array with fields described above; XSD parity maintained.
• Add tools/rdx_to_detection.py which, given an RDX document, emits at least one Sigma rule YAML and one STIX 2.1 bundle demonstrating the mapping. The exporter must insert traceability tags/metadata back to RDX object IDs.
• Examples: examples/rdx-playbook-export.json, examples/rdx-playbook-sigma.yml and examples/rdx-playbook-stix.json are included and validated where applicable.
• Documentation: methodology/ contains a "Detection Playbooks and Exports" section describing exporter behaviour, mapping conventions, and suggested CI gating patterns for detection coverage.
• REQUIREMENTS.md updated with RDX-116 and cross-reference to RDX-072..RDX-074 and RDX-055.

---

Generated by tools/ai_idea_scout.py via the AI Idea Scout workflow.
Review the proposal, refine the title/body/labels, and close if not desired.