Threat-report → detection rule automation (CVE/advisory → Sigma/SPL draft)