Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.
npx skills add https://github.com/woohyun212/security-skill --skill siem-rule
Please help me install this Agent Skill. Skill: siem-rule Source: https://github.com/woohyun212/security-skill/tree/main/siem-rule Command: npx skills add https://github.com/woohyun212/security-skill --skill siem-rule
This skill streamlines the creation and cross-platform conversion of SIEM detection rules from threat objectives, reducing duplication and handoffs across tools.
Provide a detection objective and log sources, then generate a Sigma rule and convert it to Splunk SPL, Elastic KQL/EQL, and Sentinel KQL for validation.
High-intent search queries and answers about installing and using this skill.
You can convert Sigma rules to Splunk SPL, Elastic KQL/EQL, and Sentinel KQL by using Sigma CLI tooling with platform-specific backends, generating standardized detections from a single platform-agnostic rule.
Building SIEM detection rules from threat reports or CVEs involves defining threat objectives, mapping log sources, writing a Sigma rule, and converting it to target platforms. This approach supports endpoints, network, identity, and cloud detections end-to-end.
Yes, translating detection rules across SIEM platforms requires Sigma CLI tooling, backends for Splunk, Elastic, and Microsoft Defender, Python3, and jq, along with access to sample logs for validation and tuning.
You can audit existing SIEM rules for coverage by mapping them back to threat objectives and validating against sample data, documenting tuning recommendations to minimize false positives across your deployed detection infrastructure.
Validating SIEM detection rules against sample logs requires testing the generated queries in your target platforms and documenting tuning recommendations, ensuring the detections accurately map to threat objectives while minimizing false positives.
Yes, this approach supports writing detections for cloud and identity log sources, covering endpoints, network, identity, and cloud environments within an end-to-end workflow that maps threat objectives to platform-specific queries.
incidentfoxInvestigate Splunk logs to identify root causes using SPL queries.
MHaggisOptimize Splunk SPL, Microsoft Sentinel KQL, and Elastic Security EQL/ES|QL detection queries.
refractionPOINTEvaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.
ensingm2Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.
