skills.rest
Liberty91LTD
Liberty91LTDOFFICIAL
Explore all skills by this author →
Website𝕏@liberty__91GitHub

sigma-writing

Design platform-agnostic Sigma rules in YAML for threat detection.

15|5|Updated Apr 6, 2026
Search Tags:#yaml#detection#rules#rule-writing#siem#sigma
One-click install
npx skills add https://github.com/Liberty91LTD/cti-skills --skill sigma-writing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sigma-writing
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/sigma-writing
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill sigma-writing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SIGMA Rule Writing Guide explains how to express threat-detection logic in a vendor-agnostic YAML format that can be deployed across multiple SIEM platforms.

Core Features & Use Cases

  • Describes the standard SIGMA rule structure (title, id, description, references, author, date, logsource, detection, level) and how to map detections to ATT&CK techniques.
  • Demonstrates how to write, version, and validate rules for cross-platform detection, incident response, and proactive threat hunting.
  • Provides practical examples and best practices to ensure portable, testable detections across security stacks.

Quick Start

Create a Sigma rule that detects Windows process_creation events and test it against a benign event sample.

Frequently Asked Questions about sigma-writing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules for cross-platform SIEM detection?▼

To write Sigma rules for cross-platform SIEM detection, you use a vendor-agnostic YAML schema containing fields like title, id, logsource, detection, and level to express threat-detection logic that translates across multiple security platforms.

What is the standard YAML schema structure for a Sigma detection rule?▼

The standard Sigma rule YAML schema requires fields including title, id, description, references, author, date, logsource, detection, and level. These fields define the metadata and logic necessary for portable threat detection.

How do I map Sigma rules to MITRE ATT&CK techniques?▼

You map Sigma rules to MITRE ATT&CK techniques by applying standardized tagging within the YAML structure. This maps your specific detection logic to known adversary tactics and techniques for proactive threat hunting and incident response.

Can I use Sigma rule writing for Windows process creation event monitoring?▼

Yes, you can use Sigma rule writing for Windows process creation event monitoring. You define the appropriate logsource category and craft detection logic to match specific process creation events for testing against benign samples.

What is the best way to validate Sigma rules for portability across security stacks?▼

The best way to validate Sigma rules for portability is to follow provided best practices to ensure testable detections. You version your rules and test them against benign event samples to confirm they function across different security stacks.

Related Skills

Explore More Data & Analytics Skills→
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced
AdawoduAdawodu

engineering-threat-detection-engineer

Automate Sigma SIEM rule creation, MITRE ATT&CK mapping, and detection-as-code pipelines.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
AgentSecOpsAgentSecOps
183

detection-sigma

Create, validate, and translate Sigma rules for Splunk, Elasticsearch, and Sentinel backends.

Official
Advanced