A city detection engineer uses an LLM to draft Sigma from ATT&CK notes, then tests the rule in CI. Which practice best describes that workflow?

A city detection engineer who uses an LLM to draft Sigma from ATT&CK notes and then tests the rule in CI is practicing AI-assisted detection authoring followed by automated CI testing before civic SIEM deployment. The model accelerates translation from technique notes into candidate rule structure; CI enforces that the draft parses, matches intended positive fixtures, and avoids obvious noisy negatives before any production SIEM sync. That workflow keeps generative speed while preserving municipal change control for detections that can flood 311-adjacent SOCs or miss real threats.

Why the other options fail by concept: Threat-informed Sigma authoring from ATT&CK notes with manual peer review before release substitutes a manual gate for the LLM drafting and CI fixture testing described in the question, so it does not match the workflow. Automated CI regression testing of promoted SIEM rules during post-deployment monitoring in production concerns rules already live in the environment, not the pre-deployment authoring and CI testing of a new Sigma draft. LLM-assisted triage enrichment for SOC analysts handling civic alerts during incident response deals with alert handling after detection, not with authoring Sigma rules from ATT&CK notes and validating them in CI.

Exam caveat: CI green is necessary but not sufficient; peer review and staged deployment still matter for high-volume municipal data sources. Operational check: require LLM-assisted Sigma to pass unit/fixture tests in CI and a human review checklist mapped to ATT&CK IDs before the civic SIEM promotion job can run.