detection-engineering

Name: detection-engineering
Availability: InStock
Author: brucesongs

Create and validate Sigma rules, YARA signatures, and SIEM queries as code.

60|14|Updated Apr 27, 2026

Search Tags:#ci/cd #detection #siem #sigma #yara #att&ck #evtx

Ready to run

npx skills add https://github.com/brucesongs/kali-claw --skill detection-engineering-brucesongs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/detection-engineering
Command: npx skills add https://github.com/brucesongs/kali-claw --skill detection-engineering-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detection-as-code engineering enables teams to treat detections as software artifacts with version control, automated tests, and CI/CD, reducing drift and manual handoffs.

Core Features & Use Cases

Author Sigma rules, YARA signatures, and SIEM queries as code
Test-driven validation across EVTX-ATTACK-SAMPLES and benign data
Integrate with CI/CD pipelines and ATT&CK Navigator for coverage mapping

Quick Start

Install the tooling, draft a Sigma rule for a target TTP, validate with sigma-cli parse, translate to backends, and wire in unit tests in CI.

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write Sigma rules and test them as code in a CI/CD pipeline?▼

Sigma rules are authored as code and validated using sigma-cli parse, then tested against EVTX-ATTACK-SAMPLES and benign data with unit tests wired directly into CI/CD pipelines.

What is detection-as-code engineering for SOC teams?▼

Detection-as-code engineering treats detections as software artifacts with version control, automated tests, and CI/CD, reducing drift and manual handoffs for SOC teams.

How do I validate YARA signatures against attack samples?▼

YARA signatures are validated through test-driven validation across EVTX-ATTACK-SAMPLES and benign datasets, ensuring accuracy before integration into the CI/CD pipeline.

Can I map Sigma rule coverage to MITRE ATT&CK techniques?▼

Yes, Sigma rules include ATT&CK tags for coverage mapping, and the workflow integrates with ATT&CK Navigator to visualize and satisfy quarterly review guidelines.

How do I tune false positives in SIEM queries during CI validation?▼

SIEM queries are translated to backends and validated against benign data in CI, allowing teams to tune false positives through unit tests before deployment.