detection-engineering

Design, validate, and tune detection rules across SIEM, EDR, and cloud telemetry.

3|3|Updated Mar 8, 2026

Search Tags:#cybersecurity #incident response #threat detection #mitre att&ck #detection engineering #sigma rules

Ready to run

npx skills add https://github.com/jaskaranhundal/usap-skills --skill detection-engineering-jaskaranhundal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/detection/detection-engineering
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill detection-engineering-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the critical need for effective and precise threat detection rules, ensuring that security teams can identify and respond to threats quickly while minimizing false positives.

Core Features & Use Cases

Detection Rule Authoring: Creates detection logic in formats like Sigma, KQL, SPL, and YARA.
Fidelity Assurance: Focuses on high precision and recall, aiming for a low false-positive rate (<5% week 1).
Use Case: When a new TTP is discovered by threat hunting, this Skill can be used to rapidly design, validate, and deploy a detection rule to cover that gap across SIEM and EDR platforms.

Quick Start

Use the detection-engineering skill to design a Sigma rule for detecting PowerShell encoded commands.

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write a Sigma rule to detect encoded PowerShell commands?▼

You can write Sigma rules for detecting encoded PowerShell commands by defining the process execution telemetry, specifying the base64 command-line arguments, and validating the logic to ensure high fidelity. This approach minimizes false positives while covering the specific MITRE ATT&CK TTP.

What is detection engineering and how does it improve threat detection?▼

Detection engineering is the practice of designing, validating, and tuning threat detection rules across SIEM, EDR, and cloud telemetry. It improves threat detection by focusing on TTP-level attacks with measurable ATT&CK coverage, minimizing attacker dwell time and maximizing detection fidelity.

How do I tune SIEM and EDR detections to reduce false positives?▼

Tune SIEM and EDR detections by applying documented fidelity thresholds and validating rules against real telemetry to achieve a false-positive rate below 5% in the first week. This ensures high precision and recall while maintaining effective threat coverage.

Can I use this for creating detection rules across both Splunk SPL and KQL?▼

Yes, you can author and validate detection logic across multiple platforms including Splunk SPL and KQL. The system designs rules to be deployed across SIEM, EDR, and cloud-native detection platforms to ensure comprehensive coverage.

Do I need to know YARA and Sigma to design threat detections?▼

Yes, expertise in Sigma, Splunk SPL, KQL, YARA, and cloud-native detection platforms is required. This knowledge is necessary to design high-fidelity TTP-level detections and effectively validate threat detection rules.