skills.rest
robit-man
robit-manCOMMUNITY
Explore all skills by this author →
GitHub

sigma-hunting

Applies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.

Updated Mar 11, 2026
Search Tags:#log analysis#cybersecurity#elasticsearch#threat hunting#detection rules#splunk#sigma
One-click install
npx skills add https://github.com/robit-man/transcribe-cli --skill sigma-hunting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sigma-hunting
Source: https://github.com/robit-man/transcribe-cli/tree/main/.claude/skills/sigma-hunting
Command: npx skills add https://github.com/robit-man/transcribe-cli --skill sigma-hunting

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of applying threat detection rules (Sigma) against log data, making it easier to identify malicious activity without manually writing complex queries for different systems.

Core Features & Use Cases

  • Automated Threat Hunting: Applies Sigma rules to log sources to detect threats.
  • Multi-Backend Support: Converts rules for Elasticsearch, Splunk, and grep.
  • Use Case: Automatically hunt for signs of a specific malware family (e.g., T1059) across your Linux system logs using pre-defined or custom Sigma rules.

Quick Start

Run a threat hunt using the sigma hunting skill against local log sources.

Frequently Asked Questions about sigma-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert Sigma rules to Elasticsearch or Splunk queries?▼

Sigma rules can be converted into Elasticsearch, Splunk, and grep queries to apply vendor-neutral threat detection logic directly against varied log sources and SIEM platforms.

What is Sigma threat hunting and how does it work with log analysis?▼

Sigma threat hunting applies standardized detection rules to log sources to identify malicious activity, adding MITRE ATT&CK technique context to automate the search for threats.

Can I use Sigma rules to hunt for specific malware families across Linux system logs?▼

Yes, you can hunt for specific malware families across Linux system logs by applying pre-defined or custom Sigma rules to scope and identify matching malicious activity.

Do I need a specific SIEM platform to apply Sigma detection rules?▼

No specific SIEM is required; Sigma rules convert into queries for multiple backends including Elasticsearch, Splunk, and grep, allowing flexible threat hunting across platforms.

What is the best way to automate threat hunting with Sigma rules?▼

Automating threat hunting involves applying Sigma detection rules against your log sources to automatically identify malicious activity without manually writing complex queries for different systems.

When should I not use Sigma rules for threat detection?▼

Sigma rules may not suit scenarios lacking structured log sources or requiring proprietary SIEM query languages outside its supported Elasticsearch, Splunk, and grep conversion backends.

Related Skills

Explore More Software Engineering Skills→
jmaglyjmagly
175

sigma-hunting

Apply Sigma detection rules to log sources and convert them to Elasticsearch, Splunk, and grep queries.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
AgentSecOpsAgentSecOps
183

detection-sigma

Create, validate, and translate Sigma rules for Splunk, Elasticsearch, and Sentinel backends.

Official
Advanced
Likas07Likas07

threat-detection-engineer

Develop SIEM detection rules in Sigma and map them to MITRE ATT&CK.

Community
Advanced