What problem does it solve? Writing detection rules from scratch is slow and error-prone, and analysts often don't know whether existing Sigma coverage exists for a technique, tool, or log source before investing effort. This Skill searches the SigmaHQ/sigma repository by keyword, MITRE ATT&CK technique, or log source, then converts matched rules into a target SIEM's native query syntax. ## Core Features & Use Cases - Repository-wide rule search: Query SigmaHQ/sigma via the GitHub CLI by keyword, ATT&CK technique tag (e.g. attack.t1055), or logsource fields, with a local-clone grep fallback when gh is unavailable. - Rule inspection: Fetch full rule content to review title, logsource, detection logic, false positives, and severity level before recommending it. - SIEM conversion: Convert matched rules to Splunk SPL, Elasticsearch/Lucene, KQL, and other backends using sigma-cli with the appropriate pipeline. - Use Case: A threat hunter asks whether a Sigma rule exists for Mimikatz LSASS access; the Skill finds the stable rule, confirms it requires Sysmon Event ID 10, and converts it to a Splunk SPL query ready for deployment review. ## Quick Start Search SigmaHQ for a Sigma rule covering Mimikatz LSASS access and convert the best stable match to a Splunk query.
