skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

blue-detect

Analyze detection rules and log sources against MITRE ATT&CK for coverage gaps.

Updated Jul 30, 2026
Search Tags:#log analysis#blue team#siem#mitre att&ck#detection engineering#security monitoring
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill blue-detect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: blue-detect
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/blue-detect
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill blue-detect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the lack of visibility and coverage gaps in security monitoring by providing a structured framework for detection engineering, rule validation, and signal-quality assessment without requiring active offensive execution.

Core Features & Use Cases

  • Coverage-Gap Analysis: Maps existing logs and detection rules against the MITRE ATT&CK framework to identify blind spots.
  • Signal-Quality Assessment: Evaluates false-positive rates and alert precision to tune noisy detection rules.
  • Detection-as-Code Discipline: Provides a methodology for drafting, testing, and documenting detection rules to ensure maintainability and reliability.

Quick Start

Use the blue-detect skill to analyze the provided log samples and identify coverage gaps against the MITRE ATT&CK framework.

Frequently Asked Questions about blue-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map SIEM logs against the MITRE ATT&CK framework?▼

Mapping SIEM logs against the MITRE ATT&CK framework involves analyzing your log sources and detection rules to identify security coverage gaps. This structured coverage-gap analysis highlights blind spots in your security monitoring posture without requiring active offensive execution.

What is detection-as-code discipline?▼

Detection-as-code discipline is a methodology for drafting, testing, and documenting detection rules. It ensures maintainability and reliability by treating security monitoring rules as structured code artifacts rather than standalone configurations.

How do I tune noisy SIEM rules with high false-positive rates?▼

To tune noisy SIEM rules with high false-positive rates, perform a signal-quality assessment to evaluate alert precision. This process evaluates false-positive rates during triage to improve the overall reliability of your detection engineering workflows.

Does blue-detect work for non-offensive security posture assessment?▼

Yes, blue-detect satisfies requirements for non-offensive, evidence-based security posture assessment. It provides a structured framework for detection engineering and rule validation without requiring active offensive execution or simulated attacks.

How do I document rule validation for security monitoring workflows?▼

To document rule validation for security monitoring workflows, apply detection-as-code discipline to draft, test, and document detection rules. This methodology ensures your rule validation processes remain maintainable and reliable across security operations.

Related Skills

Explore More Software Engineering Skills→
briiirussellbriiirussell
345

siem-detection

Assess log source coverage, author Sigma rules, and translate to SIEM query languages.

Community
Advanced
rajyeole6rajyeole6

agency-threat-detection-engineer

Automate Sigma detection rule validation and deployment for SIEM platforms.

Community
Advanced
augustoheissaugustoheiss

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Community
Advanced
aivos-xieaivos-xie
1

security-toolkit

Analyzes binary files, performs password attacks, and scans web vulnerabilities.

Community
Advanced