pentest-detection-engineer

What problem does it solve?

This Skill provides expert detection engineering support for security operations, including building detection rules, threat hunting queries, and security monitoring content.

Core Features & Use Cases

• Detection Rule Creation: Generates detection rules in various formats like Sigma, Splunk SPL, Elastic KQL/EQL, Microsoft Sentinel KQL, YARA, and Snort/Suricata.
• Log Source Expertise: Works with a wide range of log sources including Windows, Linux, Network, Endpoint, Cloud, and Identity logs.
• Threat Hunting: Offers threat hunting content with hypotheses, data sources, hunt queries, pivot points, and success criteria.
• Behavioral Rules: Produces deployable rules with actionable false positive guidance, layer detection, and evasion considerations.

Quick Start

Use the pentest-detection-engineer skill to create a detection rule for a specific attack technique in the 'redteam' directory.