skills.rest
martinholovsky
martinholovskyCOMMUNITY
Explore all skills by this author →
𝕏@martinholovskyGitHub

sota-detection-engineering

Construct security detections and SOC workflows from threat intelligence.

12|2|Updated Jun 17, 2026
Search Tags:#incident response#threat intelligence#SOC#detection engineering#security monitoring
One-click install
npx skills add https://github.com/martinholovsky/SOTA-skills --skill sota-detection-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sota-detection-engineering
Source: https://github.com/martinholovsky/SOTA-skills/tree/main/skills/sota-detection-engineering
Command: npx skills add https://github.com/martinholovsky/SOTA-skills --skill sota-detection-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sigma, yara, suricata, falco, tetragon, SIEM, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the challenge of building and auditing detection engineering and SOC capabilities, providing a framework for creating, testing, and validating security detections and incident response plans.

Core Features & Use Cases

  • Detection Engineering: Build Sigma, YARA, Suricata, Falco, Tetragon, or SIEM-native detections with a focus on precision and false-positive reduction.
  • SOC and Incident Response: Design and validate SOC workflows and incident response plans with a focus on threat detection, alert triage, and containment.
  • Use Case: When you need to implement a detection for a new attack technique, this Skill guides you through the process of developing a rule, testing it against known attack scenarios, and ensuring it integrates with your existing SOC infrastructure.

Quick Start

Use the sota-detection-engineering skill to create a detection for a new attack technique, ensuring it adheres to best practices for detection engineering and SOC design.

Frequently Asked Questions about sota-detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a Sigma detection rule for a new attack technique?▼

To build a Sigma detection rule, analyze threat intelligence for the adversary technique, construct the rule logic, and validate it against real-world attack scenarios to ensure precision and minimize false positives.

What is state-of-the-art detection engineering?▼

Detection engineering is the discipline of creating, testing, and validating security detections by applying threat intelligence to build precise rules integrated into SOC workflows for effective alert triage and incident response.

Can I use YARA and Suricata rules alongside my existing SIEM?▼

Yes, you can integrate YARA and Suricata rules with your SIEM by developing detections with these tools and ensuring they integrate into your existing SOC infrastructure for comprehensive security monitoring.

How do I design SOC workflows for alert triage and incident containment?▼

Design SOC workflows by mapping out threat detection, alert triage, and containment procedures, then validate these incident response plans against real-world adversary techniques to ensure effective security incident handling.

Does this approach support runtime security detections with Falco and Tetragon?▼

Yes, you can build detections using Falco and Tetragon. The framework guides you through developing runtime security rules, testing them against known attack scenarios, and validating their integration within your broader SOC monitoring infrastructure.

How do I validate detections against real-world adversary techniques?▼

Validate detections by mapping them to threat intelligence and adversary techniques, testing your rules against known attack scenarios to audit their effectiveness, ensure precision, and confirm they trigger appropriately within your SIEM environment.

Related Skills

Explore More Software Engineering Skills→
tekgrunttekgrunt

threat-intel-integrator

Integrate threat intelligence feeds into LimaCharlie detection events.

Community
Advanced
riparinoriparino
1

defensive-keylogger-detection

Detect keylogger activity using YARA rules and API hook detection.

Community
Advanced
benchflow-aibenchflow-ai
317

suricata-rules-basics

Construct Suricata network intrusion detection signatures with sticky buffers and DPI logic.

Official
Intermediate
AdawoduAdawodu

engineering-threat-detection-engineer

Automate Sigma SIEM rule creation, MITRE ATT&CK mapping, and detection-as-code pipelines.

Community
Advanced