skills.rest
Likas07
Likas07COMMUNITY
Explore all skills by this author →
GitHub

threat-detection-engineer

Develop SIEM detection rules in Sigma and map them to MITRE ATT&CK.

Updated Mar 16, 2026
Search Tags:#threat detection#threat hunting#siem#sigma#mitre att&ck#detection engineering
One-click install
npx skills add https://github.com/Likas07/t3code-skills --skill threat-detection-engineer-likas07
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-detection-engineer
Source: https://github.com/Likas07/t3code-skills/tree/main/skills/threat-detection-engineer
Command: npx skills add https://github.com/Likas07/t3code-skills --skill threat-detection-engineer-likas07

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill empowers security operations teams to build, deploy, and maintain effective threat detection capabilities, reducing dwell time and minimizing the impact of security incidents.

Core Features & Use Cases

  • SIEM Rule Development: Write and compile detection rules in Sigma for various SIEM platforms.
  • MITRE ATT&CK Mapping: Assess and improve coverage against the MITRE ATT&CK framework.
  • Threat Hunting: Develop and execute structured threat hunts to find undetected threats.
  • Detection-as-Code: Implement CI/CD pipelines for automated rule testing and deployment.
  • Use Case: A security analyst needs to create a new detection rule for a recently disclosed APT technique. They can use this Skill to generate a Sigma rule, map it to MITRE ATT&CK, test it, and deploy it to their SIEM.

Quick Start

Use the threat-detection-engineer skill to write a Sigma rule for detecting suspicious PowerShell encoded command execution.

Frequently Asked Questions about threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules for detecting suspicious PowerShell execution in my SIEM?▼

To write Sigma rules for detecting suspicious PowerShell execution, use this Skill to generate detection logic, map it to MITRE ATT&CK, and compile it for platforms like Splunk SPL or KQL.

What is detection-as-code and how does it automate threat hunting?▼

Detection-as-code automates threat hunting by implementing CI/CD pipelines for automated rule testing and deployment, ensuring high-fidelity detections are systematically validated and pushed to your SIEM.

Can I map my SIEM rules to the MITRE ATT&CK framework?▼

Yes, you can map SIEM rules to the MITRE ATT&CK framework. This Skill assesses and improves your coverage against MITRE ATT&CK techniques to identify gaps in your threat detection capabilities.

Does this support Splunk SPL and KQL for threat detection engineering?▼

Yes, it supports Splunk SPL and KQL for threat detection engineering. The Skill requires expertise in these query languages to operationalize and compile Sigma rules across various SIEM platforms.

What is the best way to deploy detection rules using CI/CD pipelines?▼

The best way to deploy detection rules using CI/CD pipelines is through detection-as-code methodologies. This Skill helps implement automated pipelines for continuous rule testing, validation, and deployment.

Why use Sigma for SIEM rule development instead of writing native queries?▼

Using Sigma for SIEM rule development provides vendor-neutral detection logic that can be compiled into native queries like Splunk SPL or KQL, enabling portable and scalable threat detection management.

Related Skills

Explore More Software Engineering Skills→
brucesongsbrucesongs
60

deception-honeypot

Deploy honeypot decoys to collect attacker telemetry and IOCs.

Community
Advanced
jc180105jc180105

Threat Detection Engineer

Author Sigma detection rules mapped to MITRE ATT&CK techniques.

Community
Advanced
ensingm2ensingm2
12

threat-modeler

Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.

Community
Advanced
UnitOneAIUnitOneAI
44

siem-rules

Develop KQL or SPL SIEM detection rules mapped to MITRE ATT&CK v16 techniques.

Official
Intermediate