skills.rest
briiirussell
briiirussellCOMMUNITY
Explore all skills by this author →
GitHub

siem-detection

Assess log source coverage, author Sigma rules, and translate to SIEM query languages.

345|47|Updated Mar 13, 2026
Search Tags:#siem#splunk#kql#sigma#mitre att&ck#detection engineering#detection-as-code
One-click install
npx skills add https://github.com/briiirussell/cybersecurity-skills --skill siem-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: siem-detection
Source: https://github.com/briiirussell/cybersecurity-skills/tree/main/skills/siem-detection
Command: npx skills add https://github.com/briiirussell/cybersecurity-skills --skill siem-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps teams build reliable SIEM detection rules by ensuring the right log sources exist, mapping detections to MITRE ATT&CK, authoring queries in common SIEM formats, and tuning to reduce false positives.

Core Features & Use Cases

  • Log source coverage assessment: identify blind spots before writing detections.
  • Rule authoring and format translation: author in Sigma and convert to SIEM-specific query languages (Sigma -> KQL/SPL/Elastic/other backends).
  • MITRE ATT&CK mapping and detection-as-code workflow: tag techniques for coverage analysis and manage rules in Git with CI/deployment checks.
  • False-positive tuning lifecycle: deploy experimentally, measure fires, narrow logic, and promote only when FP rates are acceptable.

Use it when you need to convert an attack idea into actionable detection logic, improve existing alerts that are too noisy, or report detector coverage to stakeholders/auditors.

Quick Start

Ask the AI agent: “Assess our SIEM log coverage for MITRE ATT&CK techniques relevant to account takeover, then draft Sigma rules with MITRE tags and explain how to tune false positives for my environment.”

Frequently Asked Questions about siem-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert Sigma rules to Splunk or KQL for my SIEM?▼

Sigma rules are converted to SIEM-specific query languages like Splunk or KQL through backend translation. This allows you to author detections once in Sigma and deploy them across multiple SIEM platforms.

Can I assess log source coverage for MITRE ATT&CK techniques before writing detections?▼

Yes, log source coverage assessment identifies blind spots by mapping available logs against relevant MITRE ATT&CK techniques. This ensures required data sources exist before authoring SIEM detection rules.

What is the best way to reduce false positives in SIEM detection rules?▼

Reducing false positives in SIEM detection rules requires a tuning lifecycle: deploy experimentally, measure fires, narrow logic, and promote only when FP rates are acceptable while preserving true positives.

Does detection-as-code work with Git CI for managing SIEM rules?▼

Detection-as-code manages SIEM rules in Git with CI deployment checks. This workflow treats detections as version-controlled code, enabling automated testing and structured promotion.

How do I map existing Splunk alerts to MITRE ATT&CK techniques?▼

Existing Splunk alerts are mapped to MITRE ATT&CK techniques through ATT&CK technique tagging. This process enables coverage gap analysis and helps report detector coverage to stakeholders or auditors.

Why should I use Sigma for SIEM detection engineering instead of writing native queries?▼

Sigma-first rule development provides a vendor-neutral format that translates to target SIEM backends like KQL or SPL. This approach standardizes detection engineering and prevents vendor lock-in.

Related Skills

Explore More Software Engineering Skills→
brucesongsbrucesongs
60

threat-hunting

Convert hunt hypotheses into Sigma-based detections with MITRE ATT&CK mappings.

Community
Advanced
incidentfoxincidentfox
654

splunk-analysis

Investigate Splunk logs to identify root causes using SPL queries.

Official
Intermediate
chenchunrunchenchunrun
1

ttp-extractor

Extract MITRE ATT&CK techniques from security reports and generate Sigma rules.

Community
Advanced
AgentSecOpsAgentSecOps
183

detection-sigma

Create, validate, and translate Sigma rules for Splunk, Elasticsearch, and Sentinel backends.

Official
Advanced