skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-detection-engineering

Automates Sigma rule development, validation, and deployment with MITRE Navigator mapping and FP tuning for SIEM pipelines.

1|Updated Apr 27, 2026
Search Tags:#detection#navigator#siem#sigma#mitre#fp-tuning
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-detection-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-detection-engineering
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-detection-engineering
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-detection-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detection engineering for detection rules across SIEM pipelines, enabling consistent lifecycle management from development to production.

Core Features & Use Cases

  • Sigma rule development and validation
  • MITRE ATT&CK Navigator coverage mapping and gap analysis
  • FP tuning, rule quality scoring, and promotion from experimental to stable
  • KQL-based telemetry to monitor alert volumes and production readiness
  • Use Case: Threat hunters and SOC engineers can rapidly implement and validate rules across enterprise data sources.

Quick Start

Load this skill into Claude to begin a Sigma rule development workflow with MITRE mapping and FP tuning.

Frequently Asked Questions about defensive-detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write and validate Sigma rules for enterprise SIEM pipelines?▼

Sigma rule development and validation is automated by streamlining template creation, logic checks, and syntax formatting. This ensures consistent detection rules ready for deployment across enterprise SIEM pipelines and log sources.

How does MITRE ATT&CK Navigator coverage mapping work for threat detection rules?▼

MITRE ATT&CK Navigator coverage mapping analyzes your existing Sigma rules to identify which attack techniques are monitored. It performs gap analysis to highlight uncovered threat vectors in your detection strategy.

What is the best way to tune false positive rates and promote Sigma rules to stable?▼

FP tuning and rule promotion are managed through automated quality scoring and alert volume monitoring. Rules transition from experimental to stable once false positive rates drop and production readiness is confirmed.

Can I use KQL telemetry to monitor alert volumes for Sigma rule production readiness?▼

KQL-based telemetry directly monitors alert volumes and FP rates to assess production readiness. It provides the quantitative data needed to validate rule quality before promoting experimental detections to stable environments.

Does this detection engineering workflow support threat hunters working with enterprise log sources?▼

Threat hunters and SOC engineers can rapidly implement, validate, and deploy detection rules across enterprise data sources. The workflow covers the full lifecycle from development through production deployment.

What are the limitations when deploying Sigma rules across different SIEM platforms?▼

Sigma rules provide a generic detection format, but backend-specific query translation may require manual adjustment for certain SIEM platforms. Rule validation focuses on Sigma syntax rather than native platform query optimization.

Related Skills

Explore More Data & Analytics Skills→
brucesongsbrucesongs
60

deception-honeypot

Deploy honeypot decoys to collect attacker telemetry and IOCs.

Community
Advanced
manu14357manu14357
16

azure-kusto

Write and optimize KQL queries for Azure Monitor and Data Explorer.

Community
Advanced
workromancerworkromancer

web-load2

Fetch web URLs and extract all text content.

Community
Basic
UnitOneAIUnitOneAI
44

siem-rules

Develop KQL or SPL SIEM detection rules mapped to MITRE ATT&CK v16 techniques.

Official
Intermediate