Moatazbellah Radwan
Detection Engineer
CyberNerve.ai
Moatazbellah is a Detection Engineer working at the intersection of detection engineering and applied AI. A core contributor to the DetectionHub.ai platform, Moatazbellah builds multi-SIEM detection pipelines and agentic AI systems for SOC hunting and triage and has delivered compromise assessments and participated in cyber drills.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Agentic Detection Engineering: A Threat-Informed Pipeline in Production - Case Study
Detection engineering is still a manual craft. An analyst reads a threat report, interprets the TTPs, handwrites a rule, and deploys it with no measurement of whether that rule is any good and if it add any detection coverage. The bottleneck isn't tooling. It's throughput, consistency, and the total absence of a feedback signal.This session presents Case Study, a production agentic pipeline that converts unstructured CTI reports into scored, version-controlled Sigma rules. We walk the full architecture: an extraction agent normalizes the report into structured technique claims; six specialist agents generate candidate detections in parallel, each constrained to a different logic strategy; an adjudicating Judge agent scores, merges and discards candidates; surviving rules are committed to Git with full provenance back to the source report.The center of the talk is the validation layer. We built an agent-driven benchmarking framework that scores every generated rule and sees if that adds to your coverage and ran it against +20000 rules derived from +1000 public CTI reports. We show where the agents perform well, where they fail systematically, and which failures are dangerous in particular, where a rule passes syntax validation and looks correct to a reviewer but cannot fire against real telemetry.Attendees leave with the high-level architecture, the benchmark methodology.
- 13:00
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote