skills.rest
MHaggis
MHaggisCOMMUNITY
Explore all skills by this author →
Website𝕏@M_haggisGitHub

cti-detection-engineer

Generate multi-SIEM detection logic from threat intelligence and MITRE ATT&CK mappings.

471|74|Updated Jan 13, 2026
Search Tags:#threat intelligence#siem#mitre att&ck#behavioral analysis#detection engineering#cti
One-click install
npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill cti-detection-engineer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cti-detection-engineer
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/cti-detection-engineer
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill cti-detection-engineer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill empowers users to create high-fidelity, intelligence-driven security detections that focus on adversary behaviors rather than easily changed indicators.

Core Features & Use Cases

  • Behavioral Analysis: Decomposes complex attacks into atomic behaviors for detection.
  • MITRE ATT&CK Mapping: Ensures detections are precisely mapped to the latest ATT&CK techniques and sub-techniques.
  • Multi-SIEM Compatibility: Generates detection logic applicable across Splunk, Sentinel, Elastic, and Sigma.
  • Use Case: Analyze a threat report, identify key adversary behaviors, map them to MITRE ATT&CK, and generate detection logic for your SIEM.

Quick Start

Use the cti-detection-engineer skill to analyze threat intelligence and generate a detection for MITRE ATT&CK technique T1003.001.

Frequently Asked Questions about cti-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate detection logic for Splunk or Sentinel based on a threat intelligence report?▼

Mapping threat behaviors to MITRE ATT&CK ensures detections target resilient adversary techniques rather than easily changed indicators. This approach decomposes complex attacks into atomic behaviors mapped precisely to the latest ATT&CK techniques and sub-techniques for high-fidelity detection coverage.

What is the best way to map adversary behaviors from a CTI report to MITRE ATT&CK techniques?▼

Mapping threat behaviors to MITRE ATT&CK ensures detections target resilient adversary techniques rather than easily changed indicators. This approach decomposes complex attacks into atomic behaviors mapped precisely to the latest ATT&CK techniques and sub-techniques for high-fidelity detection coverage.

Can I use Sigma rules to create behavioral detections across multiple SIEM platforms?▼

Yes, you can generate multi-SIEM compatible detection logic using Sigma and other platforms. The Skill outputs actionable detection queries for Splunk, Sentinel, and Elastic by applying behavioral analysis to identified adversary behaviors within your threat intelligence.

Why should I focus detection engineering on behavioral analysis instead of threat indicators?▼

Behavioral analysis focuses on adversary behaviors rather than easily changed indicators to create high-fidelity, intelligence-driven security detections. This method ensures your detection logic remains resilient against threat actors who frequently modify their infrastructure and toolsets.

Does this approach support generating detections for specific MITRE ATT&CK sub-techniques like T1003.001?▼

Yes, it supports generating detections for specific ATT&CK sub-techniques like T1003.001. You can analyze threat intelligence related to LSASS memory access and generate precise, high-fidelity detection logic mapped directly to that specific technique.

Related Skills

Explore More Software Engineering Skills→
rajyeole6rajyeole6

agency-threat-intelligence-analyst

Analyze raw cyber threat data into intelligence reports and detection rules.

Community
Advanced
MHaggisMHaggis
471

threat-report-parser

Parse threat reports and generate SIEM-specific detection rules mapped to MITRE ATT&CK.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-threat-actor-ttps-with-mitre-navigator

Map threat actor TTPs to MITRE ATT&CK Navigator and generate layer JSON files.

Community
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced