skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

detection-engineering

Generate Sigma detection rules and Palantir ADS documentation for MITRE ATT&CK v16 techniques.

44|128|Updated Mar 6, 2026
Search Tags:#detection-engineering#threat-detection#mitre-attack#sigma#soc-operations#palantir-ads#coverage-heatmap
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill detection-engineering-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/secops/detection-engineering
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill detection-engineering-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detection engineering turns ambiguous security needs and ATT&CK technique coverage gaps into consistent, framework-mapped Sigma detections with operational context that analysts can act on.

Core Features & Use Cases

  • Sigma rule authoring from technique scope: Converts a chosen MITRE ATT&CK technique into a Sigma detection plan and rule that targets the right data sources and data components.
  • Palantir ADS documentation for operational readiness: Produces Goal, Categorization, Strategy Abstract, Technical Context, blind spots, validation, and response guidance alongside the rule.
  • Coverage heatmap methodology: Guides systematic detection program management by mapping coverage levels across the ATT&CK matrix.

Quick Start

Use this skill when you need to create a Sigma detection for a specific ATT&CK technique using your available log sources, by asking: "Create Sigma and ADS documentation to detect T1059.001 using Windows process creation telemetry."

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create Sigma detections to cover MITRE ATT&CK technique gaps?▼

To create Sigma detections for MITRE ATT&CK gaps, scope the target technique, map available log sources and data components, construct the Sigma rule, and generate accompanying Palantir ADS documentation.

What is the Palantir ADS framework used for in detection engineering?▼

The Palantir ADS framework provides operational readiness for Sigma detections by documenting goals, categorization, strategy abstracts, technical context, blind spots, validation, and response guidance for SOC analysts.

How do I map Sigma rules to specific MITRE ATT&CK v16 techniques?▼

You can map Sigma rules to MITRE ATT&CK v16 techniques by scoping the specific technique, identifying required data sources and components, and authoring the detection logic to target the corresponding telemetry.

Can I use detection-as-code workflows to manage my SOC's ATT&CK coverage heatmap?▼

Yes, detection-as-code workflows support systematic heatmap-based detection program management by mapping coverage levels across the ATT&CK matrix to identify and reduce visibility gaps.

What do I need to generate Sigma rules and ADS documentation for T1059.001?▼

You need to scope the T1059.001 technique, map Windows process creation telemetry as the log source, and apply Sigma rule construction alongside Palantir ADS framework completion.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

analyzing-threat-actor-ttps-with-mitre-navigator

Map threat actor TTPs to MITRE ATT&CK Navigator and generate layer JSON files.

Community
Intermediate
jc180105jc180105

Threat Detection Engineer

Author Sigma detection rules mapped to MITRE ATT&CK techniques.

Community
Advanced
ensingm2ensingm2
12

threat-modeler

Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.

Community
Advanced
copyleftdevcopyleftdev

roth-detection-engineering

Create portable YARA and Sigma threat detection rules for malware hunting.

Community
Intermediate