skills.rest
sammysparks000
sammysparks000COMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-threat-detection-engineer

Write Sigma detection rules, map MITRE ATT&CK coverage, and build detection-as-code pipelines for SIEM platforms.

Updated Sep 10, 2026
Search Tags:#threat hunting#siem#splunk#mitre att&ck#detection engineering#sigma rules#detection-as-code
One-click install
npx skills add https://github.com/sammysparks000/skillshare --skill agency-threat-detection-engineer-sammysparks000
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/sammysparks000/skillshare/tree/main/skills/security-threat-detection-engineer
Command: npx skills add https://github.com/sammysparks000/skillshare --skill agency-threat-detection-engineer-sammysparks000

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security operations teams struggle with noisy SIEM alerts, untested detection rules, and unknown MITRE ATT&CK coverage gaps, leaving attackers undetected after bypassing preventive controls. ## Core Features & Use Cases - Sigma Rule Development: Write vendor-agnostic Sigma detection rules and compile them to Splunk SPL, Microsoft Sentinel KQL, Elastic EQL, or Chronicle YARA-L. - ATT&CK Coverage Mapping: Assess detection coverage against the MITRE ATT&CK matrix, identify critical gaps prioritized by threat intelligence, and build detection roadmaps. - Detection-as-Code Pipelines: Version-control rules in Git, validate syntax and ATT&CK mappings in CI, test against sample logs, and deploy automatically to SIEMs. - Use Case: A SOC drowning in 500 daily false positives uses this Skill to tune alert thresholds, document false positive profiles, and convert threat hunt findings into validated automated detections. ## Quick Start Ask the agent to write a Sigma detection rule for a specific MITRE ATT&CK technique and compile it to your SIEM platform.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Sigma detection rule for my SIEM?▼

Write the rule in vendor-agnostic Sigma YAML with title, id, level, logsource, detection logic, ATT&CK tags, and falsepositives fields. Then compile it to your target platform using sigma-cli backends for Splunk SPL, Sentinel KQL, or Elastic EQL.

How to map detection coverage to MITRE ATT&CK?▼

Tag every rule with ATT&CK technique IDs, then tally covered techniques per tactic and platform to compute coverage percentages. Prioritize gaps by threat intelligence showing which techniques real adversaries use against your industry.

Can Sigma rules be deployed to Splunk and Microsoft Sentinel?▼

Yes, sigma-cli compiles one Sigma rule into Splunk SPL, Sentinel KQL, Elastic EQL, and Chronicle YARA-L using pySigma backends. A CI/CD pipeline can validate, compile, test, and deploy rules automatically on merge to main.

Why does my detection rule generate too many false positives?▼

High false positive rates usually come from overly broad matching logic without parent process, user, or host context. Add allowlists for known benign tools, tune thresholds against historical log data, and document the false positive profile before deployment.

How do I validate that a detection rule actually works?▼

Test the rule against historical logs containing known-bad samples, then run atomic red team tests for the mapped ATT&CK technique to confirm it fires. Re-validate quarterly since adversary variants evolve and log sources can silently fail.

What are the limitations of IOC-based detection rules?▼

Static IOC matching on IPs and hashes expires quickly because attackers rotate infrastructure daily. Behavioral detections targeting process chains and anomalous patterns mapped to ATT&CK techniques provide durable coverage across the full kill chain.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

building-threat-hunt-hypothesis-framework

Builds testable threat hunt hypotheses from threat intelligence, ATT&CK techniques, and telemetry data sources.

Community
Intermediate
googlegoogle
513

secops-triage

Triage security alerts and cases using the Alert Triage Protocol.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Community
Advanced
OpenTideHQOpenTideHQ
4

sentinelone-singularity

Author SentinelOne Singularity detection content across STAR, DVQL, and SDL analytics.

Official
Advanced