AI threat-detection classifier

What this template is

Pattern: high-volume event-stream classifier. Conservative tier-boundary mapping; analyst feedback through reviewer-gate on low confidence builds the precision/recall trail over time. Spec hash + modelIdentity per entry give NIS2 Art. 23 incident-timeline reconstruction a structured starting point.

import { RuntimeAISpec } from '@promethean/runtime-ai';

export const threatDetectionSpec: RuntimeAISpec = {
  specId: 'threat-detection-v1',
  displayName: 'AI threat-detection classifier',
  description:
    'Event-stream classification: benign / suspicious / critical.',
  category: 'classifier',
  schemaVersion: 'promethean-runtime-ai-spec-1.0',
  canonicalForm: 'v1',

  inputSchema: {
    fields: [
      { name: 'eventId', type: 'string', required: true,
        redaction: 'hash-only' },
      { name: 'eventType', type: 'enum', required: true,
        enumValues: [
          'auth-attempt', 'lateral-movement', 'data-exfiltration',
          'privilege-escalation', 'malware-signature', 'unusual-network', 'other',
        ] },
      { name: 'sourceReputation', type: 'enum', required: true,
        enumValues: ['known-good', 'unknown', 'known-bad'] },
      { name: 'contextHash', type: 'string', required: true,
        redaction: 'hash-only' },
      { name: 'severityHint', type: 'number', required: false,
        min: 0, max: 10 },
    ],
  },

  outputSchema: {
    fields: [
      { name: 'verdict', type: 'enum', required: true,
        enumValues: ['benign', 'suspicious', 'critical'] },
      { name: 'rationale', type: 'string', required: true,
        maxLength: 280 },
      { name: 'mitreTechniqueIds', type: 'string-list', required: false,
        maxItems: 5, maxLength: 16 },
      { name: 'confidence', type: 'number', required: true,
        min: 0, max: 1 },
    ],
  },

  promptTemplate: {
    system:
      'You classify security events as benign / suspicious / critical. ' +
      'For critical, cite MITRE ATT&CK technique IDs in mitreTechniqueIds. ' +
      'Be precision-focused: a false-positive is acceptable noise; ' +
      'a false-negative on critical is a missed incident.',
    user:
      'Event {{eventId}} type {{eventType}}, source {{sourceReputation}}, severity hint {{severityHint}}.',
  },

  modelIdentity: {
    provider: 'anthropic',
    model: 'claude-sonnet-4-5',
    version: '20250929',
  },

  reviewerGate: 'on-low-confidence',
  lowConfidenceThreshold: 0.6,
  maxLatencyMs: 500,
  fallbackBehavior: 'deterministic-default',
  deterministicDefault: {
    verdict: 'suspicious',
    rationale: 'Fallback: classifier unavailable, flagged for SOC review.',
    confidence: 0,
  },
};

Regulations addressed

This template's configuration choices map to specific regulatory obligations. The substrate doesn't certify compliance — but the spec hash + reviewer-verdict + modelIdentity per L12 entry give you the evidence layer for these citations:

• ·NIS2 Art. 21 — cybersecurity risk-management measures
• ·NIS2 Art. 23 — incident reporting timelines
• ·DORA Art. 28 — third-party ICT (financial customers)
• ·AI Act Art. 25 — value-chain responsibilities

See citations index for official source URLs →