skills.rest
anavvanzin
anavvanzinCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-threat-detection-engineer

Author Sigma rules, map to MITRE ATT&CK, and deploy via CI/CD to SIEMs.

Updated Apr 15, 2026
Search Tags:#detection#ci-cd#siem#threat-hunting#mitre-attack#sigma
One-click install
npx skills add https://github.com/anavvanzin/Research --skill agency-threat-detection-engineer-anavvanzin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/anavvanzin/Research/tree/main/cowork/integrations/antigravity/agency-threat-detection-engineer
Command: npx skills add https://github.com/anavvanzin/Research --skill agency-threat-detection-engineer-anavvanzin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect and remediate gaps in security detections by authoring Sigma rules, mapping them to MITRE ATT&CK techniques, and coordinating CI/CD deployments to SIEMs, all while keeping alert noise to a minimum.

Core Features & Use Cases

  • Write and maintain vendor-agnostic Sigma rules and compile them for Splunk SPL, Microsoft Sentinel KQL, Elastic EQL, and Chronicle YARA-L.
  • Map detections to MITRE ATT&CK techniques, maintain a living detection catalog with data sources, false-positive profiles, and validation tests, and convert hunts into automated detections.
  • Orchestrate detection-as-code pipelines: versioned rules, CI/CD tests, atomic red team validation, and scalable deployment across SOC environments.

Quick Start

Provide a starter Sigma rule and run it through the detection pipeline to validate its syntax, test coverage, and deployment to your SIEM.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules and deploy them to Splunk or Microsoft Sentinel?▼

To write Sigma rules and deploy them to SIEMs, author vendor-agnostic Sigma detections and compile them into Splunk SPL, Sentinel KQL, Elastic EQL, or Chronicle YARA-L queries. Orchestrate deployments using detection-as-code CI/CD pipelines.

What is detection-as-code and how does it reduce SIEM false positives?▼

Detection-as-code manages SIEM detections as versioned Sigma rules deployed via CI/CD pipelines. It reduces false positives by enforcing automated validation, test data coverage, and periodic rule reviews before alerts reach production.

How do I map threat hunting queries to MITRE ATT&CK techniques?▼

Map threat hunting queries to MITRE ATT&CK techniques by maintaining a living detection catalog. This catalog tracks data sources, false-positive profiles, and validation tests, converting manual hunts into automated, versioned Sigma detections.

Can I validate Sigma rules against atomic red team tests in a CI/CD pipeline?▼

Yes, you can validate Sigma rules against atomic red team tests in a CI/CD pipeline. This detection-as-code approach tests rule syntax, coverage, and deployment to your SIEM, ensuring reproducible validation before production deployment.

What's the best way to maintain a production-grade SIEM threat detection program?▼

Maintain a production-grade SIEM threat detection program by establishing a disciplined data-source inventory, versioned Sigma rules, and lifecycle management. Author detections, map to MITRE ATT&CK, and orchestrate CI/CD deployments with periodic reviews.

Do I need a data-source inventory to reduce alert noise with Sigma rules?▼

Yes, you need a disciplined data-source inventory to reduce alert noise with Sigma rules. Maintaining clear data sources, false-positive profiles, and validation tests for your detections ensures high-fidelity alerts and minimizes SOC noise.

Related Skills

Explore More Software Engineering Skills→
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced
incidentfoxincidentfox
654

splunk-analysis

Investigate Splunk logs to identify root causes using SPL queries.

Official
Intermediate
augustoheissaugustoheiss

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Community
Advanced
AgentSecOpsAgentSecOps
183

detection-sigma

Create, validate, and translate Sigma rules for Splunk, Elasticsearch, and Sentinel backends.

Official
Advanced