sota-detection-engineering

Construct security detections and SOC workflows from threat intelligence.

12|2|Updated Jun 17, 2026

Search Tags:#incident response #threat intelligence #SOC #detection engineering #security monitoring

Ready to run

npx skills add https://github.com/martinholovsky/SOTA-skills --skill sota-detection-engineering

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sota-detection-engineering
Source: https://github.com/martinholovsky/SOTA-skills/tree/main/skills/sota-detection-engineering
Command: npx skills add https://github.com/martinholovsky/SOTA-skills --skill sota-detection-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sigma, yara, suricata, falco, tetragon, SIEM, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the challenge of building and auditing detection engineering and SOC capabilities, providing a framework for creating, testing, and validating security detections and incident response plans.

Core Features & Use Cases

Detection Engineering: Build Sigma, YARA, Suricata, Falco, Tetragon, or SIEM-native detections with a focus on precision and false-positive reduction.
SOC and Incident Response: Design and validate SOC workflows and incident response plans with a focus on threat detection, alert triage, and containment.
Use Case: When you need to implement a detection for a new attack technique, this Skill guides you through the process of developing a rule, testing it against known attack scenarios, and ensuring it integrates with your existing SOC infrastructure.

Quick Start

Use the sota-detection-engineering skill to create a detection for a new attack technique, ensuring it adheres to best practices for detection engineering and SOC design.

Frequently Asked Questions about sota-detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I build a Sigma detection rule for a new attack technique?▼

To build a Sigma detection rule, analyze threat intelligence for the adversary technique, construct the rule logic, and validate it against real-world attack scenarios to ensure precision and minimize false positives.

What is state-of-the-art detection engineering?▼

Detection engineering is the discipline of creating, testing, and validating security detections by applying threat intelligence to build precise rules integrated into SOC workflows for effective alert triage and incident response.

Can I use YARA and Suricata rules alongside my existing SIEM?▼

Yes, you can integrate YARA and Suricata rules with your SIEM by developing detections with these tools and ensuring they integrate into your existing SOC infrastructure for comprehensive security monitoring.

How do I design SOC workflows for alert triage and incident containment?▼

Design SOC workflows by mapping out threat detection, alert triage, and containment procedures, then validate these incident response plans against real-world adversary techniques to ensure effective security incident handling.

Does this approach support runtime security detections with Falco and Tetragon?▼

Yes, you can build detections using Falco and Tetragon. The framework guides you through developing runtime security rules, testing them against known attack scenarios, and validating their integration within your broader SOC monitoring infrastructure.

How do I validate detections against real-world adversary techniques?▼

Validate detections by mapping them to threat intelligence and adversary techniques, testing your rules against known attack scenarios to audit their effectiveness, ensure precision, and confirm they trigger appropriately within your SIEM environment.