skills.rest
devCharuzu
devCharuzuCOMMUNITY
Explore all skills by this author →
GitHub

threat-detection

Structure hunting hypotheses, IOC sweeps, and anomaly detection across telemetry.

Updated Apr 16, 2026
Search Tags:#telemetry#anomaly-detection#threat-detection#siem#threat-hunting#mitre-attack#ioc-analysis
One-click install
npx skills add https://github.com/devCharuzu/philfida-taskmanage --skill threat-detection-devcharuzu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-detection
Source: https://github.com/devCharuzu/philfida-taskmanage/tree/main/.windsurf/skills/threat-detection
Command: npx skills add https://github.com/devCharuzu/philfida-taskmanage --skill threat-detection-devcharuzu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Proactively identifies attacker activity by structuring hunting hypotheses, IOC analyses, and behavioral anomaly checks to reduce time-to-detection and improve signal quality.

Core Features & Use Cases

  • Hypothesis-driven threat hunting that scores potential attacker techniques and prioritizes investigations.
  • IOC sweep planning and anomaly detection to triage signals across telemetry with MITRE ATT&CK mapping.
  • Collaboration-ready workflows that connect hunting outputs to incident response and detection engineering.

Quick Start

Provide a hypothesis and data sources to receive a prioritized threat-hunting plan and recommended actions.

Frequently Asked Questions about threat-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure a threat hunting hypothesis to identify attacker activity?▼

To structure a threat hunting hypothesis, you provide a hypothesis and data sources to receive a prioritized hunting plan. This plan scores potential attacker techniques, applies MITRE ATT&CK mapping, and recommends investigation actions across telemetry.

Can I use this for IOC sweep planning and anomaly detection in my SIEM?▼

Yes, you can use it for IOC sweep planning and anomaly detection in your SIEM. It triages signals across telemetry, maps indicators to MITRE ATT&CK techniques, and requires telemetry access to SIEM or EDR along with fresh IOC feeds within 30 days.

What telemetry access and baseline data do I need for anomaly detection?▼

Anomaly detection requires telemetry access to SIEM or EDR, fresh IOC feeds within 30 days, and validated baselines. These inputs enable the anomaly mode to accurately identify behavioral deviations and triage potential attacker activity.

What is the best way to map triage alerts to MITRE ATT&CK techniques?▼

Mapping triage alerts to MITRE ATT&CK techniques is best achieved through hypothesis-driven threat hunting and IOC sweeps. This approach scores attacker techniques, prioritizes investigations, and connects hunting outputs directly to incident response workflows.

Does this support specific analysis modes for different threat hunting workflows?▼

Yes, it supports specific analysis modes for different threat hunting workflows. The threat_signal_analyzer.py script includes hunt, ioc, and anomaly modes, which are supported by reference playbooks to guide triage and investigation steps.

Why do I need validated baselines for behavioral anomaly checks in threat detection?▼

Validated baselines are required for behavioral anomaly checks to accurately distinguish malicious activity from normal network or system behavior. Without them, telemetry triage generates excessive false positives and reduces overall signal quality.

Related Skills

Explore More Data & Analytics Skills→
Patasse97Patasse97

threat-detection

Score and prioritize threat hypotheses using MITRE mappings and data-source correlations.

Community
Advanced
allanninalallanninal
1

threat-hunting

Apply Sigma detection rules to investigate security incidents.

Community
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced
riparinoriparino
1

defensive-detection-engineering

Automates Sigma rule development, validation, and deployment with MITRE Navigator mapping and FP tuning for SIEM pipelines.

Community
Advanced