detection-yaml-engineer

Generate SIEM detection rules across multiple platforms by configuring your target SIEM and security content path. This skill outputs compliant YAML for Splunk, Sigma, TOML for Elastic, and KQL for Sentinel formats.

You can validate Sigma and KQL detection rules using built-in validation commands and guidance. The skill checks adherence to naming conventions and identifies common formatting mistakes to ensure compliance.

Create a Splunk YAML template by specifying the MITRE ATT&CK technique and setting Splunk as your target platform. The generated rule includes necessary metadata mappings and test cases.

This detection engineering tool requires no external dependencies. You only need to configure the security content path and specify the target SIEM platform to begin generating and validating rules.

To ensure Elastic TOML rules include metadata and test cases, use this skill to generate templates adhering to repository standards. It automatically structures necessary MITRE mappings and validation checks.