skills.rest
patrykkopycinski
patrykkopycinskiCOMMUNITY
Explore all skills by this author →
GitHub

security-detection-engineering

Design and tune Elastic Security detection rules from hypothesis to deployment.

6|Updated Feb 20, 2026
Search Tags:#security#detection#threshold#kql#esql#rule-engineering#eql
One-click install
npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-detection-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-detection-engineering
Source: https://github.com/patrykkopycinski/elastic-cursor-plugin/tree/main/skills/security-detection-engineering
Command: npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-detection-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Validate and operationalize threat hypotheses by guiding the creation, testing, and tuning of custom detection rules across KQL, EQL, ES|QL, and threshold types to protect Elastic environments.

Core Features & Use Cases

  • Workflow-driven rule authoring: from hypothesis to rule publication with iterative tuning.
  • Multi-DSL support: KQL, EQL, ES|QL, and threshold rules for diverse data sources.
  • Use Case: Brute-force authentication detection, lateral movement, and data exfiltration, with MITRE ATT&CK mapping workflows.

Quick Start

Start by discovering available security data sources and select a detection approach to draft your first rule.

Frequently Asked Questions about security-detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create custom detection rules in Elastic Security from a threat hypothesis?▼

Elastic Security rule engineering supports KQL, EQL, ES|QL, and threshold rules to detect threats across diverse network, host, and cloud telemetry data sources within your environment.

What's the best way to tune KQL and EQL rules for brute-force authentication detection?▼

Tuning KQL and EQL rules for brute-force authentication requires iterative testing and validation against security events, applying threshold logic to minimize false positives while mapping detections to MITRE ATT&CK techniques.

Do I need specific data sources and API access to deploy ES|QL detection rules?▼

Yes, deploying ES|QL detection rules requires data sources with security events, access to discovery APIs for data source validation, and rule management APIs to publish and manage the deployed rules.

How does threshold rule engineering work for detecting lateral movement in SOC workflows?▼

Threshold rule engineering for lateral movement works by defining specific event count criteria across host and network telemetry, validating the logic with testing tooling, and iteratively tuning thresholds to operationalize detections.

Can I map custom threat detections to MITRE ATT&CK techniques using Elastic query languages?▼

Yes, you can map custom threat detections to MITRE ATT&CK techniques by authoring rules with KQL, EQL, or ES|QL, validating the query logic against your telemetry, and publishing the rules with ATT&CK mappings.

Why are my custom Elastic Security detection rules generating false positives during testing?▼

Custom detection rules generate false positives when threshold values and query logic lack iterative tuning, requiring validation against actual security events to refine the rule parameters before deployment.

Related Skills

Explore More Data & Analytics Skills→
patrykkopycinskipatrykkopycinski
6

siem-quickstart

Discover security telemetry sources and summarize posture for Elastic Security.

Community
Intermediate
AdawoduAdawodu

engineering-threat-detection-engineer

Automate Sigma SIEM rule creation, MITRE ATT&CK mapping, and detection-as-code pipelines.

Community
Advanced
vudovnvudovn
8.1k

red-team-tactics

Plan adversary simulations using MITRE ATT&CK aligned tactics.

Community
Basic
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic