skills.rest
jmagly
jmaglyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sigma-hunting

Apply Sigma detection rules to log sources and convert them to Elasticsearch, Splunk, and grep queries.

175|26|Updated Aug 14, 2025
Search Tags:#log analysis#elasticsearch#threat hunting#forensics#detection rules#splunk#sigma
One-click install
npx skills add https://github.com/jmagly/aiwg --skill sigma-hunting-jmagly
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sigma-hunting
Source: https://github.com/jmagly/aiwg/tree/main/agentic/code/frameworks/forensics-complete/skills/sigma-hunting
Command: npx skills add https://github.com/jmagly/aiwg --skill sigma-hunting-jmagly

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the process of applying Sigma detection rules against log sources to identify potential threat activity, saving significant time and effort in threat hunting.

Core Features & Use Cases

  • Sigma Rule Application: Executes Sigma rules against various log sources (journald, flat files, Elasticsearch, Splunk).
  • Rule Conversion: Translates Sigma rules into backend-specific queries (Elasticsearch, Splunk, grep).
  • Threat Triage: Reports matches, ATT&CK technique context, and flags coverage gaps.
  • Use Case: Run a comprehensive threat hunt across your system logs for specific MITRE ATT&CK techniques like T1059 (Command and Scripting Interpreter).

Quick Start

Run a full sigma hunt against local logs.

Frequently Asked Questions about sigma-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I apply Sigma detection rules to log sources for threat hunting?▼

To apply Sigma detection rules for threat hunting, the Skill executes predefined rule sets against log sources like journald, flat files, Elasticsearch, and Splunk. It identifies malicious activity by scoping threat detection based on MITRE ATT&CK techniques.

Can I convert Sigma rules to Elasticsearch or Splunk queries?▼

Yes, you can convert Sigma rules to Elasticsearch and Splunk queries. The Skill translates Sigma rules into backend-specific queries, including Elasticsearch, Splunk, and grep, allowing you to execute threat detection across different logging platforms.

Do I need sigma-cli to run Sigma rule conversion and analysis?▼

You need sigma-cli for full execution, but a grep-based fallback is available if it is not installed. The grep fallback allows basic rule execution and log analysis when sigma-cli is missing from your environment.

What is Sigma threat triage and how does it map to MITRE ATT&CK techniques?▼

Sigma threat triage reports detection matches, provides ATT&CK technique context, and flags coverage gaps. It scopes threat detection to identify malicious activity by matching log events against predefined Sigma rule sets mapped to specific MITRE ATT&CK techniques like T1059.

Does this Sigma rule hunting approach work with local journald logs?▼

Yes, this approach works with local journald logs. The Skill supports applying Sigma detection rules against various log sources, including journald, flat files, Elasticsearch, and Splunk, enabling comprehensive threat hunts across local system logs.

What is the best way to hunt for specific MITRE ATT&CK techniques like T1059 in system logs?▼

The best way to hunt for techniques like T1059 is running a comprehensive Sigma hunt across system logs. The Skill applies predefined Sigma rule sets to identify malicious activity, reports matches, and supplies ATT&CK technique context for triage.

Related Skills

Explore More Software Engineering Skills→
robit-manrobit-man

sigma-hunting

Applies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.

Community
Advanced
AradotsoAradotso
11

security-detections-mcp

Query security detection rules across multiple formats with MITRE ATT&CK coverage analysis.

Official
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
Likas07Likas07

threat-detection-engineer

Develop SIEM detection rules in Sigma and map them to MITRE ATT&CK.

Community
Advanced