Doc-foundry – AI writes Security detection rules, then proves they work

Doc-foundry is an AI system that automatically generates security detection rules and validates their effectiveness through an adversarial process involving multiple specialized AI agents and deterministic evaluation. The system produces three key artifacts: a Sigma detection rule, a threat report documenting the rule's development, and a proof bundle containing test corpora and coverage metrics that demonstrate the rule actually works rather than just claiming effectiveness. Unlike models that only write rules, Doc-foundry provides reproducible evidence of a rule's performance against real attacks and benign baselines before deployment.