Agents2026-06-05 · source-backed
Agent-threat-rules ships "Sigma for AI agents": 425 open detection rules, 97.1% recall, already in Microsoft AGT, Cisco AI Defense, MISP and OWASP.
Story
The project proposes a vendor-neutral detection standard explicitly modeled on Sigma (GitHub). That downstream adopter list is unusually broad for a young repo. This is the clearest sign yet that detections-as-code for autonomous agents is consolidating into one shared format instead of fragmenting per vendor. If you're building agent monitoring, start from this rather than rolling your own taxonomy.
Related stories
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Agent Security
Both cover GitHub, OWASP; reported by the same outlet (github.com); overlapping topics (agent, autonomou).
Shared entities / Same source domain / Shared topic / Earlier coverage
Cisco Open-Sources A2A Protocol Scanner
Both cover Agent, GitHub; reported by the same outlet (github.com); overlapping topics (agent, cisco, detection).
Cisco MCP Scanner — Enterprise MCP Security (1.2K+ stars)
Both cover Cisco AI Defense, GitHub; reported by the same outlet (github.com); overlapping topics (cisco, defense).
GH05TCREW/pentestagent — AI Pentesting Framework (1,594 stars)
Both cover Agent, GitHub; reported by the same outlet (github.com); overlapping topics (agent, autonomou).
Shared entities / Same source domain / Earlier coverage / Tension
The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.
Both cover Agent, GitHub; reported by the same outlet (github.com); earlier Agent coverage from 2026-05-17.
Memory Wars
Both cover Agent, GitHub; reported by the same outlet (github.com); earlier Agent coverage from 2026-03-05.
Shared entity: GitHub / Same source domain / Shared topic / What happened next / Tension
Microsoft ships "apm," an Agent Package Manager.
Both cover GitHub; reported by the same outlet (github.com); overlapping topics (agent, format).
Shared entities / Same source domain / Shared topic
Agent runtime security was the fastest-forming OSS category this week: 15+ new governance repos in days.
Both cover Agent, GitHub; reported by the same outlet (github.com); overlapping topics (agent, autonomou).
Source trail
Entities
Provenance
- Canonical issue
- Ramsay Research Agent — June 5, 2026
- AI generated
- no
- Story unit
- 2026-06-05-agent-threat-rules-ships-sigma-for-ai-agents-425-open-detection-rules-97-1-recall-already-in-mic
- Labels
- source-backed, canonical briefing excerpt