skills.rest
hiktan44
hiktan44COMMUNITY
Explore all skills by this author →
GitHub

Threat Detection Engineer

Develops and maintains SIEM security detections using Sigma and MITRE ATT&CK mapping.

Updated Aug 27, 2026
Search Tags:#threat detection#threat hunting#siem#mitre att&ck#detection engineering#sigma rules
One-click install
npx skills add https://github.com/hiktan44/deer-flow --skill threat-detection-engineer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Threat Detection Engineer
Source: https://github.com/hiktan44/deer-flow/tree/main/skills/public/engineering-threat-detection-engineer
Command: npx skills add https://github.com/hiktan44/deer-flow --skill threat-detection-engineer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical gap in cybersecurity by enabling the creation and maintenance of robust detection mechanisms that identify and alert on malicious activities that bypass preventative security controls.

Core Features & Use Cases

  • SIEM Rule Development: Write and deploy high-fidelity detection rules in Sigma, compiled for various SIEM platforms (Splunk, Sentinel, Elastic).
  • MITRE ATT&CK Mapping: Assess and systematically improve coverage against the MITRE ATT&CK framework, prioritizing critical gaps.
  • Threat Hunting: Develop and execute hunt hypotheses to find threats missed by automated detections, converting findings into new rules.
  • Detection-as-Code: Implement CI/CD pipelines for version-controlled, tested, and automated deployment of detection rules.
  • Use Case: A security operations team needs to ensure they can detect advanced persistent threats (APTs) targeting their industry. This Skill allows them to build, test, and deploy specific detection rules mapped to the TTPs used by these APTs, significantly reducing their mean time to detect.

Quick Start

Use the Threat Detection Engineer skill to create a Sigma rule for detecting suspicious PowerShell encoded command execution.

Frequently Asked Questions about Threat Detection Engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules for detecting suspicious PowerShell execution in Splunk?▼

To write Sigma rules for PowerShell detection, this Skill develops high-fidelity behavioral detections and compiles them into SIEM query languages like SPL for deployment in Splunk.

How does MITRE ATT&CK mapping improve threat hunting playbooks?▼

MITRE ATT&CK mapping improves threat hunting by systematically assessing detection coverage against adversary TTPs, enabling operationalized intelligence to find threats missed by automated alerts.

Can I use CI/CD pipelines for automated detection-as-code deployment to Sentinel?▼

Yes, you can use CI/CD pipelines for automated detection-as-code deployment, compiling Sigma rules into KQL for version-controlled, tested deployment to Microsoft Sentinel.

What is the best way to convert threat intelligence into actionable hunting hypotheses?▼

The best way to convert threat intelligence into actionable hypotheses is to develop and execute hunt missions that identify bypassed malicious activities, converting findings into new SIEM detections.

Do I need to know adversary emulation techniques to build high-fidelity SIEM detections?▼

Yes, expertise in adversary emulation techniques is required to build high-fidelity SIEM detections, ensuring behavioral analysis accurately identifies malicious activities bypassing preventative controls.

Does this approach support Elastic SIEM query languages for detecting advanced persistent threats?▼

Yes, this approach supports Elastic SIEM, compiling Sigma rules into the platform's query language to detect advanced persistent threats targeting specific industries.

Related Skills

Explore More Software Engineering Skills→
SanctifiedOpsSanctifiedOps
3

wallet-monitoring-bot

Monitor Solana wallet activity and send alerts across multiple channels.

Community
Intermediate
ollieb89ollieb89

red-team-tactics

Coordinate structured red-team simulations across MITRE ATT&CK phases.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
riparinoriparino
1

defensive-detection-engineering

Automates Sigma rule development, validation, and deployment with MITRE Navigator mapping and FP tuning for SIEM pipelines.

Community
Advanced