NGR Softlab Adds a Rule to Its Alertix SIEM for Detecting LLM-Based Attacks

NGR Softlab has added a new correlation rule to its Alertix SIEM. The rule is meant to detect suspicious activity linked to cyberattacks based on language models. CNews reported the update on 12 October 2026. The available excerpt contains no numbers: how many scenarios the rule covers, which event sources it uses, or which version it ships in. This article therefore lays out the context rather than implementation details.

What we know about the release

Alertix is a SIEM from the Russian vendor NGR Softlab. A correlation rule in products like this does something simple: it matches events from different sources (network devices, proxies, application logs, user accounts) and raises an incident when those events add up to a characteristic chain. A single request to an external service means nothing. The same request after an unusual login and a large data export looks very different.

According to CNews, the rule is designed to detect attacks in which adversaries use language models. The source does not specify which techniques it catches: phishing generation, automated reconnaissance, malicious code written with an LLM, or attacks on corporate models themselves.

Why SIEMs have to learn to see LLMs

Language models change the threat profile from two sides. The first is the attackers. A model speeds up the preparation of emails, scripts and social engineering scenarios, lowers the barrier to entry and increases the volume of attempts. The second is the infrastructure being defended. Companies are deploying chatbots, assistants and agents with access to internal data, and that creates new attack points: prompt injection, leaks through queries, and abuse of API keys.

For a SIEM, this means new types of telemetry and new patterns. Classic rules were written for malware, brute force and lateral movement. Traffic to LLM services and requests to internal model gateways do not fit those templates.

What the published excerpt confirms:

• Vendor: NGR Softlab
• Product: Alertix SIEM
• Type of change: new correlation rule
• Purpose: detecting suspicious activity linked to attacks that use language models
• Date of report: 12 October 2026, source: CNews

Not disclosed: the number of detection scenarios, the list of event sources, licensing terms, whether the rule maps to MITRE ATT&CK, and the false positive rate.

What customers should check

A correlation rule is only as useful as the data it runs on. If an organization has no proxy logs that categorize LLM services, no logs from an internal AI gateway, and no audit of API calls, there will be nothing to detect, no matter how sophisticated the logic.

Before deploying, ask the vendor for three things: a list of required event sources, a description of the trigger conditions, and false positive statistics from pilots. You also need to decide who in the SOC owns triage for these incidents: a first-line analyst with no experience in LLM threats will not be able to tell an attack from an employee's normal use of an assistant. Finally, the rule covers only part of the problem. Inventorying corporate models and controlling the permissions of their agents remain separate work.