Context-Aware SIEM Rule Generation with LLMs: When Site Profiles Are Not Enough - Schafhauzer, Priscila; Kapelinski, Cristhian; Pohlmann, Marcio; Kreutz, Diego (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Security Information and Event Management (SIEM) platforms ship rulesets that are agnostic to the monitored organization, so a failed login receives the same severity in every environment. We investigate whether an LLM, conditioned only on a short organization profile and a catalog of native Wazuh rule identifiers, can write local rules that bring automated severity classification closer to human analyst judgment. On 1,000 stratified SSH authentication events from two production servers, the LLM-augmented configuration lowers accuracy by 4.4 percentage points and weighted F 1 by 3.1 points relative to the native baseline. We trace the regression to a single failure mode, the over-escalation of unsuccessful login attempts from external sources, and discuss why aggregated F 1 is a coarse proxy for rule quality.