skills.rest
MHaggis
MHaggisCOMMUNITY
Explore all skills by this author →
Website𝕏@M_haggisGitHub

detection-reviewer

Validate security detection rules in SPL, KQL, Sigma, and Elastic formats.

471|74|Updated Jan 13, 2026
Search Tags:#quality assurance#threat hunting#SIEM#security operations#MITRE ATT&CK#detection engineering
One-click install
npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill detection-reviewer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection-reviewer
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/detection-reviewer
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill detection-reviewer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical need for rigorous quality assurance in security detection rules, ensuring their accuracy, effectiveness, and operational readiness before deployment.

Core Features & Use Cases

  • Comprehensive Rule Validation: Performs multi-stage checks on detection rules, covering structure, logic, threat intelligence mapping, false positive risk, test coverage, and operational impact.
  • Multi-Format Support: Works with rules in SPL, KQL, Sigma, and Elastic formats.
  • Use Case: A security engineer needs to review a newly developed Splunk detection rule for a critical MITRE ATT&CK technique. They use this Skill to ensure the rule is performant, accurate, has adequate test coverage, and clearly documented investigation steps.

Quick Start

Use the detection-reviewer skill to validate the attached Splunk detection rule file 'suspicious_process_creation.spl'.

Frequently Asked Questions about detection-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate security detection rules for accuracy and false positive risk?▼

Validating security detection rules involves an 8-stage review framework that checks structural integrity, logical accuracy, false positive risk, and test coverage to ensure operational readiness before deployment.

Does detection rule quality assurance work with KQL, Sigma, and Elastic query formats?▼

Detection rule quality assurance supports multiple formats including SPL, KQL, Sigma, and Elastic, using platform-specific validation commands to verify structural integrity and logical accuracy.

How do I verify MITRE ATT&CK mapping and test coverage for SIEM detection rules?▼

Verifying MITRE ATT&CK mapping and test coverage is achieved through a multi-stage review process that assesses threat intelligence mapping, test coverage, and operational impact for SIEM rules.

What is the best way to review Splunk detection rules for threat hunting operations?▼

The best way to review Splunk detection rules is using an 8-stage validation framework that ensures performant logic, accurate threat intelligence mapping, and clearly documented investigation steps.

Can I assess operational effectiveness and false positive risk before deploying detection rules?▼

You can assess operational effectiveness and false positive risk during the quality assurance process, which evaluates logical accuracy, test coverage, and operational impact prior to rule deployment.

Why does detection engineering require a multi-stage validation framework?▼

Detection engineering requires a multi-stage validation framework because it systematically verifies structural integrity, logical accuracy, and threat intelligence mapping, preventing ineffective rules from reaching production environments.

Related Skills

Explore More Software Engineering Skills→
Likas07Likas07

threat-detection-engineer

Develop SIEM detection rules in Sigma and map them to MITRE ATT&CK.

Community
Advanced
rajyeole6rajyeole6

agency-threat-detection-engineer

Automate Sigma detection rule validation and deployment for SIEM platforms.

Community
Advanced
SanctifiedOpsSanctifiedOps
3

wallet-monitoring-bot

Monitor Solana wallet activity and send alerts across multiple channels.

Community
Intermediate
yunseo-kimyunseo-kim
1

gitlab-ci-patterns

Generate GitLab CI/CD pipeline patterns for build, test, and deploy stages.

Community
Intermediate