e12ex2/Qwen3-1.7B-SigmaRL

TEXT GENERATIONConcurrent Unit Cost:1Model Size:2BQuant:BF16Context Size:32kTool Calling:SupportedPublished:Jul 4, 2026License:apache-2.0Architecture:Transformer Open Weights Featherless Exclusive Cold

e12ex2/Qwen3-1.7B-SigmaRL is a 2 billion parameter LoRA fine-tune of Qwen3-1.7B, specifically designed for defensive detection engineering. This model excels at generating valid, backend-compilable Sigma detection rules from natural-language threat descriptions. It achieves a 45.8% success rate in producing valid and Splunk-compilable rules, a significant improvement over its base model. The primary use case is assisting blue-team security professionals in automating the creation of Sigma rules.

Loading preview...

Qwen3-1.7B-SigmaRL: A Specialized Model for Defensive Detection Engineering

This model, developed by e12ex2, is a LoRA fine-tune of the Qwen3-1.7B architecture, specifically engineered for generating Sigma detection rules from natural language threat descriptions. It is a defensive-use-only prototype, focusing on blue-team security operations.

Key Capabilities

  • Sigma Rule Generation: Translates natural language threat descriptions into valid and compilable Sigma rules.
  • Improved Performance: Achieves a 45.8% success rate in generating rules that are both valid YAML and compilable to a Splunk query, compared to 0.0% for the base Qwen3-1.7B model.
  • Graded Verifiable Reward: Utilizes pySigma and a Splunk backend as an oracle for evaluating rule correctness, driving its fine-tuning process.

How it was Made

  • Base Model: Qwen/Qwen3-1.7B
  • Training Data: Over 3,000 (description → rule) pairs derived from SigmaHQ.
  • Methodology: LoRA SFT via MLX-LM, trained locally on an Apple M4.

Limitations

  • Prototype Status: Approximately 54% of outputs may still contain schema errors, even if valid YAML.
  • Context Truncation: Trained with 512-token truncation, which may affect the generation of longer rules.
  • Single-Turn Generation: Designed for single-turn interactions, requiring human review before deployment.

Good for

  • Security Analysts: Automating the initial drafting of Sigma detection rules.
  • Detection Engineers: Rapidly converting threat intelligence into actionable detection logic.
  • Blue Teams: Enhancing efficiency in creating and deploying security monitoring rules.

Finetunes
1 models