CTI-REALM: leaderboard
Microsoft detection-engineering benchmark where agents interpret cyber threat intelligence, inspect telemetry, and produce Sigma/KQL detection rules across Linux, AKS, and Azure cloud scenarios.
Metric: Normalized Reward. Source: arxiv.org. Saturation forecast: Around February 2027. 16 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Opus 4.6 (High) | 0.64 | #63 (Claude Opus 4.6) |
| 2 | Claude Opus 4.5 | 0.62 | #83 |
| 3 | Claude Sonnet 4.5 | 0.59 | #142 |
| 4 | GPT-5 (Medium) | 0.57 | #98 (GPT-5) |
| 5 | GPT-5.2 (Medium) | 0.57 | #110 (GPT-5.2) |
| 6 | GPT-5 (High) | 0.56 | #98 (GPT-5) |
| 7 | GPT-5.2 (High) | 0.55 | #110 (GPT-5.2) |
| 8 | GPT-5 (Low) | 0.54 | #98 (GPT-5) |
| 9 | GPT-5.1 (Medium) | 0.51 | #135 (GPT-5.1) |
| 10 | GPT-5.1 (High) | 0.49 | #135 (GPT-5.1) |
| 11 | GPT-5.2 (Low) | 0.49 | #110 (GPT-5.2) |
| 12 | O3 | 0.47 | #124 |
| 13 | GPT-5 Mini | 0.45 | #186 |
| 14 | GPT-4.1 | 0.42 | #248 |
| 15 | GPT-5.1 (Low) | 0.37 | #135 (GPT-5.1) |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=cti-realm · How It Works · Data refreshed daily, snapshot 2026-10-20.