Adel Ahmed
Threat Detection Engineer
CyberNerve.ai
Adel Ahmed is a Detection Engineer and R&D enthusiast with over four years of experience in Security Operations and Detection Engineering. Currently at CyberNerve.ai, he builds large-scale security automation pipelines. As the Tech Lead of DetectionHub.ai, Adel architects AI-driven, multi-agent workflows that transform unstructured threat intelligence into high-fidelity, validated Sigma rules. His work focuses on operationalizing threat intelligence, improving detection coverage, and developing agentic frameworks to benchmark detection logic at scale.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Agentic Detection Engineering: A Threat-Informed Pipeline in Production - Case Study
Detection engineering is still a manual craft. An analyst reads a threat report, interprets the TTPs, handwrites a rule, and deploys it with no measurement of whether that rule is any good and if it add any detection coverage. The bottleneck isn't tooling. It's throughput, consistency, and the total absence of a feedback signal.This session presents Case Study, a production agentic pipeline that converts unstructured CTI reports into scored, version-controlled Sigma rules. We walk the full architecture: an extraction agent normalizes the report into structured technique claims; six specialist agents generate candidate detections in parallel, each constrained to a different logic strategy; an adjudicating Judge agent scores, merges and discards candidates; surviving rules are committed to Git with full provenance back to the source report.The center of the talk is the validation layer. We built an agent-driven benchmarking framework that scores every generated rule and sees if that adds to your coverage and ran it against +20000 rules derived from +1000 public CTI reports. We show where the agents perform well, where they fail systematically, and which failures are dangerous in particular, where a rule passes syntax validation and looks correct to a reviewer but cannot fire against real telemetry.Attendees leave with the high-level architecture, the benchmark methodology.
- 13:00
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote