UNUM LLM Attack Story & Detection Engineering One-Pager

UNUM

AI Security / Detection Engineering Consultant

Context

Delivered a two-month consulting engagement for UNUM that used LLM-assisted attack-tree and attack-story generation, MITRE ATT&CK mapping, ServiceNow asset inventory, data-center and campus architecture context, CISO risk framing, Zero Trust tagging, synthetic log generation, and Splunk SPL detection engineering to create realistic enterprise attack scenarios and testable detection logic.

Problem

Enterprise detection engineering often fails because generic attack scenarios do not reflect the organization's actual assets, architecture, controls, business impact paths, or risk language. UNUM needed a way to generate realistic attack stories grounded in its infrastructure and ServiceNow asset inventory, map those stories to MITRE ATT&CK and control groups, and turn them into usable detections and test data.

What I did

• - Used LLM-assisted workflows to generate, iterate, and refine realistic enterprise attack trees and attack stories.
• - Grounded attack scenarios in UNUM's ServiceNow asset inventory and architecture context rather than generic attack templates.
• - Incorporated data-center and campus architecture details to ensure the scenarios could plausibly target relevant infrastructure and services.
• - Mapped attack paths to MITRE ATT&CK tactics, techniques, and enterprise-relevant behavior patterns.
• - Aligned scenarios to CISO-level enterprise risk, actual impact paths, and control group expectations.
• - Tagged attack stories with Zero Trust buckets, relevant devices, infrastructure components, control types, and security policy categories.
• - Translated attack stories into detection engineering requirements and Splunk SPL query logic.
• - Generated realistic synthetic logs and data to support detection testing without relying on unsafe or unavailable production evidence.
• - Iterated scenarios and detections so outputs became usable for validation, communication, and security engineering rather than remaining conceptual AI output.

Outcome

• - Delivered an innovative AI-assisted detection engineering engagement for a major insurance enterprise.
• - Created realistic enterprise attack stories tied to actual asset and architecture context.
• - Mapped scenarios to MITRE ATT&CK, control groups, security policy categories, and Zero Trust concepts.
• - Produced Splunk SPL detection logic derived from realistic infrastructure-targeted attack paths.
• - Generated synthetic logs and data for detection testing and validation.
• - Demonstrated a practical pattern for AI-assisted security engineering: use LLMs to accelerate structured attack reasoning, but anchor outputs in assets, controls, telemetry, and testable detections.

Evidence

• - Two-month paid consulting engagement.
• - Used LLM-assisted attack-tree and attack-story generation.
• - Mapped scenarios to MITRE ATT&CK and control groups.
• - Used ServiceNow asset inventory and enterprise architecture context.
• - Produced Splunk SPL queries for detection engineering.
• - Generated realistic synthetic logs and data for testing.