A city detection engineer wants LLM detection suggestions grounded in the local Sigma and detection-rule git repository. Which approach best achieves that?

City detection engineers who need LLM suggestions grounded in the local Sigma and detection-rule git repository should use retrieval-augmented generation (RAG). RAG retrieves relevant chunks from an authorized corpus and conditions generation on those passages, so proposed rules, queries, or explanations stay tied to municipal standards rather than unaugmented model memory. That design is the practical way to keep generative assistance honest about what the city’s repo actually contains.

The correct approach works because grounding is an explicit retrieval step: the assistant must pull real files or snippets from the Sigma/git corpus before speaking. Outputs can cite paths, rule IDs, and wording that engineers can open and verify in source control.

Fine-tuning the model on the city's Sigma and detection-rule git corpus to encode rule patterns directly into model weights for suggestions fails because baking patterns into weights is not retrieval; without an explicit lookup of the local git corpus at inference time, the model can still generate plausible-looking rules that diverge from current city conventions. Encoding the corpus into parameters does not give the assistant a verifiable path or retrieved chunk, so suggestions cannot be traced to the files engineers can open in source control.

Building a prompt cache of the city's Sigma and detection-rule git corpus so reused rule prefixes accelerate new suggestion generation fails because caching is a performance optimization, not retrieval; it reuses identical prefixes to speed up generation but does not look up the most relevant rule chunks for each new request. Without query-specific retrieval from the git corpus, suggestions have no verifiable retrieved passage to cite and cannot be shown to reflect current city standards.

Using the city's Sigma and detection-rule git corpus commit API to enrich prompts with version messages and diff statistics for suggestions fails because commit messages and diff counts describe changes, not the rule content itself. Enriching prompts with version history metadata may add context about activity, but without retrieving the actual local detection-rule files it still leaves suggestions unconnected to source-controlled Sigma logic engineers can verify.

Exam caveat: Stems that stress “grounded in the local … repository” are pointing at RAG (or equivalent retrieval), not weight-encoded fine-tuning, prompt caching for prefix reuse, or commit-message/diff-stat enrichment.

Operational check: Index the detection-rule git corpus, require retrieved citations in suggestions, and reject any generation path that cannot show the file path or commit-backed chunk used.