detection-rule-development

What problem does it solve?

This Skill addresses the need for a robust detection rule development process that is mapped to MITRE ATT&CK and includes test cases and false-positive tuning.

Core Features & Use Cases

• Detection Rule Development: Develop detection rules (Sigma, YARA, KQL/SPL/EQL) for specific behaviors or threats.
• Mapping to MITRE ATT&CK: Ensures detection rules are aligned with known attack patterns and techniques.
• Test Cases & False-Positive Tuning: Includes a methodical approach to testing detection rules and addressing false positives, ensuring effectiveness without alert fatigue.

Quick Start

Create a detection rule for a new behavior or threat, mapped to MITRE ATT&CK, by using the detection-rule-development skill.