siem-rule

What problem does it solve?

This skill streamlines the creation and cross-platform conversion of SIEM detection rules from threat objectives, reducing duplication and handoffs across tools.

Core Features & Use Cases

• Full lifecycle: define threat objectives, map log sources, write a platform-agnostic Sigma rule, and convert to Splunk SPL, Elastic KQL/EQL, and Microsoft Sentinel KQL.
• Validation & tuning: test against sample data and document tuning recommendations to minimize false positives.
• Use cases: build new detections from CVEs or threat reports, audit existing rules for coverage, and translate Sigma rules for rapid platform deployments.
• End-to-end workflow supports endpoints, network, identity, and cloud detections.

Quick Start

Provide a detection objective and log sources, then generate a Sigma rule and convert it to Splunk SPL, Elastic KQL/EQL, and Sentinel KQL for validation.