skills.rest
jc180105
jc180105COMMUNITY
Explore all skills by this author →
GitHub

Threat Detection Engineer

Author Sigma detection rules mapped to MITRE ATT&CK techniques.

Updated Apr 16, 2026
Search Tags:#detection#siem#threat-hunting#mitre-attack#sigma#detection-as-code#alert-tuning
One-click install
npx skills add https://github.com/jc180105/.opencode --skill threat-detection-engineer-jc180105
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Threat Detection Engineer
Source: https://github.com/jc180105/.opencode/tree/main/.opencode/skills/engineering-threat-detection-engineer
Command: npx skills add https://github.com/jc180105/.opencode --skill threat-detection-engineer-jc180105

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Designs and maintains precise, scalable detection rules to reduce alert fatigue, improve MITRE ATT&CK coverage, and enable detection-as-code pipelines for SOC teams.

Core Features & Use Cases

  • Write and maintain Sigma rules and their cross-platform compilations (Splunk, Sentinel, Elastic) for behavior-based detections.
  • Map every detection to MITRE ATT&CK techniques, validate with atomic red team exercises, and maintain a tuned false positives catalog.
  • Enable CI/CD deployment of detections, maintain a living detections catalog, and support threat hunting with repeatable playbooks.

Quick Start

Describe a detection objective and I will generate a production-ready Sigma rule, deployment plan, and testing guidance.

Frequently Asked Questions about Threat Detection Engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules for SIEM detections across multiple platforms?▼

To write Sigma rules for SIEM detections, you author generic detection logic that compiles into platform-specific queries for Splunk, Sentinel, or Elastic. This enables behavior-based detections across Windows, Linux, and cloud environments.

What is detection-as-code and how does it improve threat hunting?▼

Detection-as-code applies CI/CD pipelines to manage and deploy detection rules. It improves threat hunting by enabling repeatable playbooks, maintaining a living detection catalog, and validating rules with atomic red team exercises.

How do I reduce SIEM alert fatigue and tune false positives?▼

To reduce SIEM alert fatigue and tune false positives, you maintain a living catalog tracking data sources and false positive frequencies. This ensures your SOC team operates with high-fidelity detections mapped to MITRE ATT&CK techniques.

Can I validate MITRE ATT&CK detections using atomic red team exercises?▼

Yes, you can validate MITRE ATT&CK detections using atomic red team exercises. Mapping every detection to specific ATT&CK techniques allows you to actively test rule efficacy and ensure high-fidelity alerts before deployment.

Does this approach support cloud and hybrid environments for behavior-based detections?▼

Yes, this approach supports cloud and hybrid environments for behavior-based detections. You can apply Sigma rules across Windows, Linux, and cloud infrastructure to maintain precise, scalable detection coverage.

Related Skills

Explore More Software Engineering Skills→
jay6697117jay6697117

agency-threat-detection-engineer

Author Sigma detection rules and validate them through CI/CD pipelines.

Community
Advanced
rajyeole6rajyeole6

agency-threat-detection-engineer

Automate Sigma detection rule validation and deployment for SIEM platforms.

Community
Advanced
MHaggisMHaggis
471

cti-detection-engineer

Generate multi-SIEM detection logic from threat intelligence and MITRE ATT&CK mappings.

Community
Advanced
oborchersoborchers
28

security-monitoring-from-day-one

Deploy managed cloud security services for threat detection and compliance scanning.

Community
Advanced