skills.rest
augustoheiss
augustoheissCOMMUNITY
Explore all skills by this author →
GitHub

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Updated Feb 11, 2026
Search Tags:#detection-engineering#siem#threat-hunting#mitre-attack#sigma#detection-as-code
One-click install
npx skills add https://github.com/augustoheiss/LogicDefense --skill agency-threat-detection-engineer-augustoheiss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/augustoheiss/LogicDefense/tree/main/.gemini/skills/agency-threat-detection-engineer
Command: npx skills add https://github.com/augustoheiss/LogicDefense --skill agency-threat-detection-engineer-augustoheiss

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detection gaps and noisy alerts leave SOCs blind or overwhelmed; this Skill reduces missed intrusions and alert fatigue by producing behavior-focused, tested detections and repeatable hunt playbooks that map to MITRE ATT&CK.

Core Features & Use Cases

  • Sigma-first rule authoring: author vendor-agnostic Sigma rules and compile them to Splunk SPL, Microsoft Sentinel KQL, and Elastic EQL.
  • Detection-as-code CI/CD: validate rules in CI, run tests against sample logs, and deploy compiled rules through automated pipelines to production SIEMs.
  • Threat hunting & coverage reporting: run hunt queries, convert findings into rules, and produce MITRE ATT&CK coverage reports and roadmaps to close critical gaps.
  • Use Case: Convert a manual LSASS credential-dumping hunt into a Sigma rule, validate with atomic red team tests, compile to Sentinel KQL, and deploy via GitHub Actions.

Quick Start

Draft a Sigma rule that detects encoded PowerShell execution, validate it against historical logs, compile to your SIEM backend, and submit a PR to the detection-as-code pipeline.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does detection-as-code help reduce SIEM alert fatigue and false positives?▼

To create SIEM detections, you author vendor-agnostic Sigma rules that compile directly into Splunk SPL, Microsoft Sentinel KQL, and Elastic EQL. This approach standardizes rule creation across multiple SIEM backends while maintaining high-fidelity threat detection.

Can I use this for MITRE ATT&CK coverage assessment and threat hunting?▼

Detection-as-code reduces SIEM alert fatigue by validating Sigma rules in CI pipelines against sample logs before deployment. This automated testing ensures only high-fidelity, behavior-focused detections reach production, minimizing noisy alerts and false positives.

What is the best way to convert a manual threat hunt into a deployed SIEM rule?▼

Yes, this supports MITRE ATT&CK coverage assessment by generating detailed coverage reports and roadmaps from threat hunting queries. It maps converted findings into Sigma rules to close critical detection gaps across Windows, Linux, and cloud telemetry.

Do I need a CI/CD pipeline to manage detection engineering with Sigma rules?▼

Convert hunt findings into a Sigma rule, validate against historical logs with atomic red team tests, compile to your SIEM backend language, and deploy via CI/CD automation. This streamlines transitioning manual hunts into production-ready detections.

Do I need a CI/CD pipeline to manage detection engineering with Sigma rules?▼

A CI/CD pipeline is essential for detection-as-code workflows to validate Sigma rules, run tests against sample logs, and automate deployment to production SIEMs. This ensures detections are tested and reliable before going live.

Related Skills

Explore More Software Engineering Skills→
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced
jassicsjassics
6

detection-rule-development

Develop and review detection rules mapped to MITRE ATT&CK with test cases.

Community
Advanced
jay6697117jay6697117

agency-threat-detection-engineer

Author Sigma detection rules and validate them through CI/CD pipelines.

Community
Advanced