Hi Mathieu and the droid team,
I have been reading droid's source (platforms registry, AbstractPlatform, sources/sigmahq.py, convert.py, PR #48) and want to ask a scope question before doing anything else.
I maintain Agent Threat Rules (https://github.com/Agent-Threat-Rule/agent-threat-rules), an MIT-licensed YAML detection-rule corpus for AI agent runtime threats. 348 rules covering prompt injection, tool poisoning, context exfiltration, agent loop exploits.
The structural question. droid is tightly bound to pySigma: sources reads SigmaHQ format, convert.py routes through sigma.conversion.base.Backend, deploy targets SIEM/EDR platforms via pySigma backends. ATR rule YAML is not Sigma syntax. So an "ATR platform" in droid's vocabulary does not fit (platforms are SIEM destinations), and a literal "ATR backend" would force droid to model a non-pySigma rule schema. That is a much larger refactor than I would propose to a project of this scope.
What might be in scope: a one-shot ATR-to-Sigma converter that emits Sigma-compliant YAML for the subset of ATR rules that are log-observable (rules that fire on structured event traces from agent runtimes). droid would then consume that emitted Sigma exactly as it consumes SigmaHQ today, with zero changes inside droid. I would maintain the converter as a separate repo on my side.
Two questions:
-
Is broadening droid's source scope beyond Sigma on the roadmap at all, or is staying pySigma-native the intentional design choice?
-
If the answer is pySigma-native (which is what I would expect given the architecture), would you be open to a single link in the droid-docs Resources section pointing to the ATR-to-Sigma converter once it exists? droid users who care about agent-runtime detection could find it. No code change in droid.
If neither is in scope, that is a clean answer. I have seen the WildDogOne XDR PRs from 2024 and your platform-registry refactor in #48, so I know the bar is concrete code that fits the existing architecture, not framework discussions. I would rather not waste your review time on a misfit proposal.
For context: ATR is in production at Microsoft Agent Governance Toolkit (PR #908 merged), Cisco AI Defense (314-rule pack), MISP via adulau (taxonomies #323 merged 2026-05-10), and OWASP Agent-Security-Regression-Harness (#74 merged). This is part of a small wave I am sending to EU and US public-sector projects this week. No urgency.
Repo: https://github.com/Agent-Threat-Rule/agent-threat-rules
Maintainer: Adam Lin, adam@agentthreatrule.org
Foundation: Panguard AI Inc., Delaware C-Corp filed 2026-05-12
Hi Mathieu and the droid team,
I have been reading droid's source (platforms registry, AbstractPlatform, sources/sigmahq.py, convert.py, PR #48) and want to ask a scope question before doing anything else.
I maintain Agent Threat Rules (https://github.com/Agent-Threat-Rule/agent-threat-rules), an MIT-licensed YAML detection-rule corpus for AI agent runtime threats. 348 rules covering prompt injection, tool poisoning, context exfiltration, agent loop exploits.
The structural question. droid is tightly bound to pySigma: sources reads SigmaHQ format, convert.py routes through sigma.conversion.base.Backend, deploy targets SIEM/EDR platforms via pySigma backends. ATR rule YAML is not Sigma syntax. So an "ATR platform" in droid's vocabulary does not fit (platforms are SIEM destinations), and a literal "ATR backend" would force droid to model a non-pySigma rule schema. That is a much larger refactor than I would propose to a project of this scope.
What might be in scope: a one-shot ATR-to-Sigma converter that emits Sigma-compliant YAML for the subset of ATR rules that are log-observable (rules that fire on structured event traces from agent runtimes). droid would then consume that emitted Sigma exactly as it consumes SigmaHQ today, with zero changes inside droid. I would maintain the converter as a separate repo on my side.
Two questions:
Is broadening droid's source scope beyond Sigma on the roadmap at all, or is staying pySigma-native the intentional design choice?
If the answer is pySigma-native (which is what I would expect given the architecture), would you be open to a single link in the droid-docs Resources section pointing to the ATR-to-Sigma converter once it exists? droid users who care about agent-runtime detection could find it. No code change in droid.
If neither is in scope, that is a clean answer. I have seen the WildDogOne XDR PRs from 2024 and your platform-registry refactor in #48, so I know the bar is concrete code that fits the existing architecture, not framework discussions. I would rather not waste your review time on a misfit proposal.
For context: ATR is in production at Microsoft Agent Governance Toolkit (PR #908 merged), Cisco AI Defense (314-rule pack), MISP via adulau (taxonomies #323 merged 2026-05-10), and OWASP Agent-Security-Regression-Harness (#74 merged). This is part of a small wave I am sending to EU and US public-sector projects this week. No urgency.
Repo: https://github.com/Agent-Threat-Rule/agent-threat-rules
Maintainer: Adam Lin, adam@agentthreatrule.org
Foundation: Panguard AI Inc., Delaware C-Corp filed 2026-05-12