skills.rest
brucesongs
brucesongsCOMMUNITY
Explore all skills by this author →
GitHub

detection-engineering

Create and validate Sigma rules, YARA signatures, and SIEM queries as code.

60|14|Updated Apr 27, 2026
Search Tags:#ci/cd#detection#siem#sigma#yara#att&ck#evtx
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill detection-engineering-brucesongs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/detection-engineering
Command: npx skills add https://github.com/brucesongs/kali-claw --skill detection-engineering-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detection-as-code engineering enables teams to treat detections as software artifacts with version control, automated tests, and CI/CD, reducing drift and manual handoffs.

Core Features & Use Cases

  • Author Sigma rules, YARA signatures, and SIEM queries as code
  • Test-driven validation across EVTX-ATTACK-SAMPLES and benign data
  • Integrate with CI/CD pipelines and ATT&CK Navigator for coverage mapping

Quick Start

Install the tooling, draft a Sigma rule for a target TTP, validate with sigma-cli parse, translate to backends, and wire in unit tests in CI.

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules and test them as code in a CI/CD pipeline?▼

Sigma rules are authored as code and validated using sigma-cli parse, then tested against EVTX-ATTACK-SAMPLES and benign data with unit tests wired directly into CI/CD pipelines.

What is detection-as-code engineering for SOC teams?▼

Detection-as-code engineering treats detections as software artifacts with version control, automated tests, and CI/CD, reducing drift and manual handoffs for SOC teams.

How do I validate YARA signatures against attack samples?▼

YARA signatures are validated through test-driven validation across EVTX-ATTACK-SAMPLES and benign datasets, ensuring accuracy before integration into the CI/CD pipeline.

Can I map Sigma rule coverage to MITRE ATT&CK techniques?▼

Yes, Sigma rules include ATT&CK tags for coverage mapping, and the workflow integrates with ATT&CK Navigator to visualize and satisfy quarterly review guidelines.

How do I tune false positives in SIEM queries during CI validation?▼

SIEM queries are translated to backends and validated against benign data in CI, allowing teams to tune false positives through unit tests before deployment.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

log-analysis

Parse and analyze security logs to detect anomalous activity.

Community
Intermediate
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-threat-actor-ttps-with-mitre-navigator

Map threat actor TTPs to MITRE ATT&CK Navigator and generate layer JSON files.

Community
Intermediate
omeraltnomeraltn

agency-threat-detection-engineer

Automate SIEM detection rule development and MITRE ATT&CK mapping.

Community
Advanced