AegisOps AI: ROCm MITRE Detection Factory

AegisOps AI is not a chatbot. It is a purple-team detection workflow engine: known attacker behavior becomes validated defensive readiness. Security teams cannot operationalize threat intelligence fast enough. Translating ATT&CK techniques into precise detections, SOC response guidance, and coverage validation is still mostly manual, creating generic rules, noisy alerts, and a bottleneck around scarce detection engineering expertise. AegisOps AI closes that gap with a 4-agent LangGraph pipeline: Threat Agent: generates high-fidelity ATT&CK simulation, Office-lineage process execution, encoded command patterns, script block telemetry, network callout patterns, and file artifacts. Detection Agent: converts those observables into a layered Sigma rule with primary, corroborating, and fallback signal layers, field mappings, Event IDs, and realtime SIEM/EDR detection plans. Response Agent: produces triage, containment, hunt, escalation, and reporting guidance tied to specific observables. Validation Agent: scores coverage across six dimensions, identifies production gaps, outputs structured JSON. Routed to a Qwen verifier sidecar. Live inference on AMD Instinct MI300X via vLLM on ROCm. Four simulation modes: Single Technique, APT Group, Kill Chain, and Hunting Topology Lab. Exports include Sigma YAML, Splunk SPL, SOC Playbook, VECTR JSON, and PDF report bundle.