skills.rest
imMamdouhaboammar
imMamdouhaboammarCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-threat-detection-engineer

Writes Sigma detection rules, maps MITRE ATT&CK coverage, and builds detection-as-code CI/CD pipelines.

Updated Jul 27, 2026
Search Tags:#threat hunting#siem#splunk#mitre att&ck#detection engineering#sigma rules#detection-as-code
One-click install
npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-threat-detection-engineer-immamdouhaboammar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/imMamdouhaboammar/Mimera/tree/main/.agents/skills/security-threat-detection-engineer
Command: npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-threat-detection-engineer-immamdouhaboammar

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security operations teams struggle with noisy SIEM alerts, blind spots in MITRE ATT&CK coverage, and untested detection rules that either fire on everything or catch nothing. This Skill provides an expert detection engineer persona that builds high-fidelity behavioral detections, validates them against real log data, and keeps false positive rates under control. ## Core Features & Use Cases - Vendor-Agnostic Rule Authoring: Writes Sigma detection rules and compiles them to Splunk SPL, Microsoft Sentinel KQL, and Elastic EQL with documented false positive profiles and ATT&CK mappings. - ATT&CK Coverage Assessment: Produces coverage matrices by tactic, identifies critical gaps prioritized by threat intelligence, and builds quarterly detection roadmaps. - Detection-as-Code Pipelines: Provides GitHub Actions CI/CD templates that validate Sigma syntax, enforce required fields, compile to target SIEMs, and deploy automatically. - Threat Hunting Playbooks: Converts hunt hypotheses (e.g., LSASS credential dumping via Sysmon Event 10) into repeatable queries and then into automated detections. - Use Case: A SOC analyst discovers zero coverage for T1003.001 (LSASS memory dumping). Use this Skill to write a tested Sigma rule, compile it to Sentinel KQL, add it to the CI/CD pipeline, and validate it with an atomic red team test. ## Quick Start Ask the agent to write a Sigma detection rule for a specific MITRE ATT&CK technique and compile it to your SIEM platform.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Sigma detection rule and deploy it to Splunk or Sentinel?▼

Write the rule in vendor-agnostic Sigma YAML with title, id, level, ATT&CK tags, logsource, detection logic, and falsepositives fields. Then compile it with sigma-cli using pySigma backends to generate Splunk SPL or Sentinel KQL, and deploy through a CI/CD pipeline.

How do I measure MITRE ATT&CK detection coverage for my SIEM?▼

Map every active detection rule to at least one ATT&CK technique, then tally coverage per tactic against the full technique list for your platform. Prioritize gaps using threat intelligence about techniques actually used against your industry, such as T1003.001 credential dumping.

How do I reduce false positives in SIEM detection rules?▼

Tune rules by adding parent process, user, or command-line context, and maintain documented allowlists for known benign tools like SCCM. Track per-rule true positive rates and disable rules that consistently generate noise without remediation.

Why did my detection rule stop firing after working for months?▼

Rules that silently stop firing usually indicate a log source ingestion failure rather than absent attacker activity. Monitor log source completeness for dependencies like Sysmon Event ID 10, and re-validate rules quarterly with atomic red team tests.

What is detection-as-code and why use it for SIEM rules?▼

Detection-as-code treats SIEM rules as version-controlled software: rules live in Git, pass syntax and ATT&CK-mapping validation in CI, get tested against sample logs, and deploy automatically. This prevents untested console edits and ensures every rule is peer-reviewed and reproducible.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

building-threat-hunt-hypothesis-framework

Builds testable threat hunt hypotheses from threat intelligence, ATT&CK techniques, and telemetry data sources.

Community
Intermediate
googlegoogle
513

secops-triage

Triage security alerts and cases using the Alert Triage Protocol.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Community
Advanced
jaskaranhundaljaskaranhundal
3

detection-engineering

Design, validate, and tune detection rules across SIEM, EDR, and cloud telemetry.

Community
Advanced