Transform SIEM rules with behavior-based threat detection