skills.rest
jay6697117
jay6697117COMMUNITY
Explore all skills by this author →
Website𝕏@nullGitHub

agency-threat-detection-engineer

Author Sigma detection rules and validate them through CI/CD pipelines.

Updated Mar 22, 2026
Search Tags:#detection-engineering#threat-detection#siem#threat-hunting#mitre-attack#sigma#alert-tuning
One-click install
npx skills add https://github.com/jay6697117/agency-agents-antigravity --skill agency-threat-detection-engineer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/jay6697117/agency-agents-antigravity/tree/main/.agents/skills/agency-threat-detection-engineer
Command: npx skills add https://github.com/jay6697117/agency-agents-antigravity --skill agency-threat-detection-engineer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat detection engineering addresses the gap between prevention and detection by building, validating, and maintaining high-fidelity SIEM detections that map to MITRE ATT&CK, while reducing false positives and enabling scalable detection programs.

Core Features & Use Cases

  • Detection Rule Authoring: Write Sigma rules and compile to Splunk, Sentinel, and Elastic.
  • MITRE Coverage & Roadmaps: Map detections to ATT&CK techniques and plan gap-fill roadmaps.
  • Threat Hunting & Validation: Create hunt playbooks and convert discoveries into automated detections.

Quick Start

Create a basic Sigma rule for a common technique, wire it through the detection CI/CD pipeline, and validate it against a representative test dataset.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write high-fidelity SIEM detections that map to MITRE ATT&CK?▼

To write high-fidelity SIEM detections, author deterministic Sigma rules, map them to MITRE ATT&CK techniques, and validate them against representative test datasets within a CI/CD pipeline to reduce false positives.

Can I compile Sigma rules for Splunk, Sentinel, and Elastic SIEM platforms?▼

Yes, you can compile Sigma rules for Splunk, Sentinel, and Elastic. The detection engineering process supports writing Sigma rules and converting them for use across these multiple SIEM platforms.

What is the best way to tune SIEM alert rules and reduce false positives?▼

The best way to tune SIEM alerts and reduce false positives is to apply alert tuning during the detection rule authoring process, validating the deterministic Sigma rules against a representative test dataset via CI/CD pipelines.

Does threat detection engineering support Windows, Linux, and cloud environments?▼

Yes, threat detection engineering supports Windows, Linux, cloud, and container environments. It enables detection rule authoring, MITRE mapping, and threat hunting across these diverse infrastructure platforms.

How do I convert threat hunting discoveries into automated SIEM detections?▼

To convert threat hunting discoveries into automated SIEM detections, create hunt playbooks to identify threats, then author deterministic Sigma rules based on those findings and wire them through a detection CI/CD pipeline.

How do I plan MITRE ATT&CK coverage gap-fill roadmaps for my detections?▼

To plan MITRE ATT&CK coverage gap-fill roadmaps, map existing SIEM detections to ATT&CK techniques, identify coverage gaps, and maintain a living detection catalog with metadata like MITRE mappings and validation tests.

Related Skills

Explore More Software Engineering Skills→
masermediagroup-stackmasermediagroup-stack
1

siem-logging

Configure centralized SIEM logging and detection-rule development across cloud and on-prem environments.

Community
Advanced
augustoheissaugustoheiss

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Community
Advanced
rajyeole6rajyeole6

agency-threat-detection-engineer

Automate Sigma detection rule validation and deployment for SIEM platforms.

Community
Advanced
robit-manrobit-man

sigma-hunting

Applies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.

Community
Advanced