skills.rest
bomberoxenviosdosruedas
bomberoxenviosdosruedasCOMMUNITY
Explore all skills by this author →
GitHub

agency-threat-detection-engineer

Develop and deploy SIEM detection rules mapped to MITRE ATT&CK.

1|Updated May 5, 2026
Search Tags:#cybersecurity#threat hunting#SIEM#MITRE ATT&CK#detection-as-code#alert tuning
One-click install
npx skills add https://github.com/bomberoxenviosdosruedas/01EnviosDosRueda --skill agency-threat-detection-engineer-bomberoxenviosdosruedas
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/bomberoxenviosdosruedas/01EnviosDosRueda/tree/main/.agents/workflows/agency-threat-detection-engineer
Command: npx skills add https://github.com/bomberoxenviosdosruedas/01EnviosDosRueda --skill agency-threat-detection-engineer-bomberoxenviosdosruedas

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sigma, python, git, CI/CD, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a comprehensive toolkit for security operations teams to detect and respond to threats, improving overall cybersecurity posture.

Core Features & Use Cases

  • SIEM Rule Development: Automates the creation of SIEM detection rules using Sigma language.
  • MITRE ATT&CK Mapping: Maps detection rules to the MITRE ATT&CK framework for comprehensive coverage.
  • Threat Hunting: Facilitates the identification of threats that automated detections may miss.
  • Alert Tuning: Optimizes alerting systems to reduce false positives and improve response times.
  • Detection-as-Code: Implements detection rules through version-controlled, automated pipelines.
  • Use Case: For a security team dealing with a high volume of alerts, this Skill can help prioritize and validate threats, leading to more efficient incident response.

Quick Start

Execute the threat detection pipeline to identify potential threats in your environment.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SIEM detection rules using detection-as-code?▼

Automate SIEM detection rules by writing rules in Sigma, mapping them to the MITRE ATT&CK framework, and deploying them through version-controlled CI/CD pipelines using Python.

What is the best way to map threat detection rules to the MITRE ATT&CK framework?▼

Mapping threat detection rules to the MITRE ATT&CK framework provides comprehensive coverage by aligning Sigma-based SIEM alerts with specific adversary tactics and techniques.

How do I tune SIEM alerts to reduce false positives in complex threat landscapes?▼

Tune SIEM alerts by optimizing detection rules and leveraging threat hunting workflows to identify and filter out false positives, improving incident response times.

Can I use Python and Sigma to deploy threat detections through a CI/CD pipeline?▼

Yes, you can implement detection-as-code by developing Sigma rules with Python and automating their deployment and threat hunting execution via CI/CD pipelines.

How does threat hunting complement automated SIEM detections?▼

Threat hunting facilitates the identification of stealthy threats that automated SIEM detections may miss, actively validating and prioritizing threats for more efficient incident response.

Related Skills

Explore More Software Engineering Skills→
masermediagroup-stackmasermediagroup-stack
1

siem-logging

Configure centralized SIEM logging and detection-rule development across cloud and on-prem environments.

Community
Advanced
riparinoriparino
1

defensive-initial-access

Detect malicious Office macros, drive-by downloads, and phishing via Sigma rules and KQL signals.

Community
Intermediate
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced
rajyeole6rajyeole6

agency-threat-detection-engineer

Automate Sigma detection rule validation and deployment for SIEM platforms.

Community
Advanced