• Aayeda Khan
• Trupti Asolkar

Modern cybersecurity setups generate amounts of mixed logs and events which makes it really hard to find the threats that are important and look into suspicious activity fast. Rule based detection is still useful because the logic is clear and easy for analysts to believe in while machine learning based anomaly detection can find behavior that no rule was written for. But in reality these two methods usually work in systems so the signals from anomalies rarely connect properly to security evidence, investigation steps or the daily management of the models that create them. This paper introduces AegisML, a rule-first evidence-driven MLOps framework made for cybersecurity anomaly detection and investigation. It combines detection rules, policies, signatures IOC matching and event correlation with an Isolation Forest based behavioral anomaly model. Importantly the ML part is not asked to decide if something is an attack; instead it provides extra behavioral evidence that analysts can use with all other information. AegisML also connects events, detections, findings and investigations through relationships based on evidence. Includes MLOps practices like dataset management, experiment tracking, model versioning, registration, drift monitoring and controlled retraining. In short AegisML bridges the gap, between security detection and ML lifecycle management by bringing evidence, analysis, investigation and model governance together in one system. Its main contribution is not an anomaly detection algorithm but a more connected, trackable and controlled way of doing cybersecurity anomaly detection.

Cybersecurity, Anomaly Detection, MLOps, Security Logs, Isolation Forest, Evidence Driven Investigation, Security Analytics, Model Lifecycle, Drift Detection, Model Governance.

"A Rule-First and Evidence-Driven MLOps Framework for Cybersecurity Anomaly Detection and Investigation", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 9, page no.b458-b464, September-2026, Available :http://www.jetir.org/papers/JETIR2609152.pdf

"A Rule-First and Evidence-Driven MLOps Framework for Cybersecurity Anomaly Detection and Investigation", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 9, page no. ppb458-b464, September-2026, Available at : http://www.jetir.org/papers/JETIR2609152.pdf