Analytic Story Builder

Create grouped detection narratives in Splunk ESCU YAML format.

471|74|Updated Jan 13, 2026

Search Tags:#threat intelligence #siem #mitre att&ck #detection engineering #security monitoring #analytic stories

Ready to run

npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill analytic-story-builder

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Analytic Story Builder
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/analytic-story-builder
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill analytic-story-builder

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill streamlines the process of organizing individual security detection rules into cohesive "analytic stories" that represent specific threat scenarios, campaigns, or attack chains, improving overall security posture clarity and management.

Core Features & Use Cases

Narrative Grouping: Consolidates related detections into a single, understandable threat story.
SIEM Adaptation: Provides canonical formats (Splunk ESCU) adaptable to Elastic, Sentinel, Sigma, and Chronicle SOAR.
Use Case: When a new ransomware campaign emerges, use this Skill to group all newly created detections related to that campaign into a single "Analytic Story" for easier tracking and reporting.

Quick Start

Use the Analytic Story Builder skill to create a new story for the 'STORM-0501 Ransomware' campaign.

Frequently Asked Questions about Analytic Story Builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What are analytic stories in threat intelligence detection engineering?▼

Analytic stories group individual security detection rules into cohesive threat narratives representing specific campaigns or attack chains. This organization improves security posture clarity by consolidating related detections into a single, understandable threat story.

How do I group detections into a threat narrative using MITRE ATT&CK mappings?▼

You group detections into threat narratives by creating an analytic story that defines descriptions, references, and MITRE ATT&CK mappings. Detections are then associated with these stories through tags, linking individual rules into a coherent campaign structure.

Can I use Splunk ESCU YAML format to create analytic stories for Microsoft Sentinel?▼

Yes, the Splunk ESCU YAML format serves as a canonical structure adaptable to multiple SIEM platforms. You can use this format to define stories adaptable to Elastic, Microsoft Sentinel, Sigma, and Chronicle SOAR environments.

Does this SIEM detection grouping approach work with Elastic Security?▼

Yes, detection grouping works with Elastic Security. The canonical Splunk ESCU YAML format provides a baseline structure that adapts to Elastic, Microsoft Sentinel, Sigma, and Chronicle SOAR for managing threat narratives.

What is the best way to organize new ransomware campaign detections in a SIEM?▼

The best way to organize ransomware campaign detections is creating a single analytic story. This groups all newly created detections related to that specific campaign together, enabling easier tracking and reporting across the threat lifecycle.

Are there limitations when adapting Splunk ESCU YAML analytic stories to other SIEM platforms?▼

The primary limitation is format adaptation overhead. While Splunk ESCU YAML acts as a canonical format, adapting the stories to Elastic, Sentinel, Sigma, or Chronicle SOAR requires mapping the narrative structures and tags to each platform's native schema.