HEFAISTOS

Stop Writing Garbage Detections: Meet the Maieutic Engine

[ 2026-07-03 // hunt3r ]

Let’s face facts: most detection engineering pipelines are glorified suggestion boxes where half-baked ideas go to die. We’ve all seen it. An analyst gets a caffeine rush, scribbles down “detect malicious identity behavior” or “catch bad PowerShell,” and calls it a day. The result is typically untestable, lacks telemetry context, and has absolutely zero triage playbook built out. It is a fast track to alert fatigue.

That is exactly why we built the Maieutic Engine right into the HEFAISTOS platform.

What in the World is the Maieutic Engine?

The Maieutic Engine is HEFAISTOS’s guided detection-engineering assistant. It does not write detections for anyone, because we aren’t trying to replace analysts with hallucinating chatbots. Instead, it ruthlessly interrogates initial ideas using structured Socratic questioning.

It drags users through a five-stage workflow to prove the concept:

  1. Hypothesis
  2. Interrogation
  3. Robustness
  4. Playbook
  5. Review

The ultimate goal is to take vague, unpolished intent and hammer it into a testable, operationally grounded detection package that actually works in the real world.

Why It Exists (Or: Why We Can’t Have Nice Things)

Detection ideas stall out for the exact same predictable reasons:

  • The scope is way too broad and practically untestable.
  • Telemetry details are missing, guaranteeing a massive wave of false positives.
  • Playbook steps for triage and response are incomplete.
  • Valuable context gets lost in chat logs instead of making it into the actual Workbench fields.

The Maieutic Engine fixes this mess by forcing concrete, stage-specific answers. Once the idea is actually thought through, it stages the output for a controlled import directly into the Workbench.

How the Sausage Gets Made

The engine isn’t just a basic prompt wrapper; it is a fully integrated workflow designed to keep focus intact.

1. The UI Workflow

Maieutic opens as a sleek modal directly from the Playbook Workbench. You cannot just skip to the end; required fields strictly control progression through the stages. We included an AI readiness score, but it acts as advisory coaching rather than a hard blocker. If the required fields are filled out, progression is allowed, even if the AI thinks the idea still needs refinement.

2. Context-Aware Kickoff

If context already exists in the Workbench, Maieutic grabs it and runs with it. It actively looks at:

  • The selected MITRE ATT&CK technique (for example, T1218.005)
  • The technique name
  • The detection focus layer
  • Any existing Workbench goals and context
  • Selected capability abstractions

It uses this data to pre-seed empty Hypothesis fields, shape the kickoff prompts, and ground the backend AI from the very first interaction. If starting naked with blank fields, it will just ask baseline setup questions to get the ball rolling.

3. The AI Interaction Model

Every time there is an interaction, the backend hits the AI providers via GraphQL (maieuticQuestion) and returns structured JSON containing:

  • A teaching note
  • One highly specific Socratic question
  • An answer template
  • A completion check
  • Field suggestions and autofill candidates

Because analyst skill levels vary, the assistant’s challenge level can be tuned:

  • Light: Guided coaching mode designed for less-experienced users.
  • Standard: A balanced depth for day-to-day workflow.
  • Expert: Advanced challenge mode for veteran detection engineers.

4. Knowledge Grounding & The Repeat-Question Guard

Generic AI answers are garbage. Our backend grounding combines the current message, the form context, the Workbench context, and snapshots of Active Detection Chokepoints (if available). This reduces generic answers and keeps the questioning heavily ATT&CK-aware.

And if the AI tries to get stuck in a loop and asks the same question twice? We built a guard for that. Backend logic detects the similarity, nukes the redundant prompt, and forces a gap-focused question tied to whatever is actually missing.

The Stages of Interrogation

Bypassing the required fields is not an option. Here are the rules of engagement:

Hypothesis

  • Required: Detection Intent and Technical Capability.
  • Purpose: Define the actual behavior and scope to detect. Stop just naming tool sets.

Interrogation

  • Required: At least one solid Q&A log entry.
  • Purpose: Capture the field-level evidence and any technical uncertainties.

Robustness

  • Required: Data Quality, False Positive Rate, Coverage & Blind Spots, and Overall Justification.
  • Purpose: Stress-test the resilience of the rule and identify its operational limits.

Playbook

  • Required: Manual steps or SOAR playbook content.
  • Purpose: Turn the detection into usable response actions.

Review

  • Required: All prior stages must be satisfied.
  • Purpose: Confirm readiness before staging the data for import. The AI might still chirp with advice here, but it is strictly advisory.

Output Mapping: Putting It in the Workbench

Once the Socratic gauntlet is survived, the output seamlessly maps into the HEFAISTOS Workbench:

  • Hypothesis appends to goal.
  • Q&A log appends to technicalContext.
  • Robustness appends to blindSpots and falsePositives.
  • Playbook design appends to responsePlaybook.
  • Detection rule overwrites with the specific format and rule. (And let’s be completely clear—we are not messing around with SIGMA as a universal language anymore. We expect native, hard-hitting queries like KQL or SPL).
  • Review synthesis maps to triageGuidance, testScenario, and testExpectedOutput, plus any optional SOAR or testing extras.

Design Principles

We built this with a few non-negotiable rules:

  1. Analyst-First: The AI assists, but the analyst always decides.
  2. Structured Progress: Stage requirements keep the output from being useless.
  3. Context Grounding: Prefer ATT&CK and chokepoint-aware prompts.
  4. Safe Imports: Data is staged before application to avoid silent, destructive writes.
  5. Practical Coaching: Actionable next-best steps are provided, not vague feedback.

Troubleshooting Your Weaknesses

Things going sideways? Here is how to fix it:

  • Stuck on repeating questions? Confirm the required fields for the stage are filled, or literally ask the AI: What am I still missing?. If it is too strict, drop the challenge level to Light. Ensure the Workbench technique context is set before opening Maieutic.
  • No useful context being used? Verify the Workbench actually has a selected ATT&CK technique and saved strategy context. Re-open Maieutic so the kickoff prompt includes the fresh data.
  • Output imported but fields look partial? Check the import toggles in the Review stage. Re-run the Review synthesis and apply it again if triage or testing sections are missing.

How to Fire Up the Maieutic Engine

Alright, time to get to work. Firing up the Maieutic Engine is dead simple, and there are two ways to do it:

  1. From the Workbench Hub: Navigate to the main “Workbench Hub” page and click the “Maieutic Engine” option located right in the top right corner.
  2. Inside a New Workbench: Once a new workbench is created, it can be launched at any time. Just look in the top right corner for the BULB icon and click it to start the engine.

Stop guessing, start interrogating the logic, and let’s actually build detections that matter.