skills.rest
Patasse97
Patasse97COMMUNITY
Explore all skills by this author →
GitHub

threat-detection

Score and prioritize threat hypotheses using MITRE mappings and data-source correlations.

Updated Apr 9, 2026
Search Tags:#detection#anomaly#threat#threat-hunting#ioc#mitre
One-click install
npx skills add https://github.com/Patasse97/claude-skills --skill threat-detection-patasse97
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-detection
Source: https://github.com/Patasse97/claude-skills/tree/main/engineering-team/threat-detection
Command: npx skills add https://github.com/Patasse97/claude-skills --skill threat-detection-patasse97

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Threat detection teams require a structured, scalable approach to identify attacker activity before incidents by scoring hypotheses, planning IOC sweeps, and aligning signals to MITRE ATT&CK tactics.

Core Features & Use Cases

  • Hypothesis scoring: Rapidly evaluate and rank threat hypotheses using data sources and ATT&CK mappings.
  • IOC sweep planning: Generate targeted sweep plans across logs and threat intel to validate hypotheses.
  • MITRE-aligned prioritization: Map findings to ATT&CK techniques and prioritize detections for engineering and SOC teams.

Quick Start

Provide a threat hypothesis to the analyzer and run threat_signal_analyzer.py in hunt mode to obtain a prioritized score and recommended actions.

Frequently Asked Questions about threat-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I score and prioritize threat hunting hypotheses using MITRE ATT&CK mappings?▼

Threat hunting hypotheses are scored and prioritized by evaluating data sources and mapping signals to MITRE ATT&CK techniques. This approach ranks potential attacker activities to focus detection engineering and SOC efforts on the highest priority threats.

What is the best way to plan an IOC sweep across SIEM and EDR telemetry?▼

Planning an IOC sweep involves using a consumable IOC file with an analyzer tool to generate targeted sweep plans. It validates hunting hypotheses by correlating indicators of compromise across SIEM and EDR telemetry for comprehensive threat detection.

Do I need a specific file format to perform anomaly detection and proactive threat hunting?▼

Yes, proactive threat hunting requires a consumable IOC file containing indicators of compromise. This file is processed alongside predefined keyword mappings to structure the sweep and detect anomalies across security telemetry.

Can I use this approach to align threat intel findings with ATT&CK techniques for SOC teams?▼

Yes, findings from the threat signal analysis are mapped directly to MITRE ATT&CK techniques. This alignment prioritizes detections and provides actionable recommended actions for engineering and SOC teams.

How does threat signal analysis work for identifying attacker activity before an incident?▼

Threat signal analysis works by scoring hunting hypotheses against correlated data sources and ATT&CK mappings. It proactively identifies attacker activity by validating indicators across logs and threat intel before an incident occurs.

Related Skills

Explore More Data & Analytics Skills→
devCharuzudevCharuzu

threat-detection

Structure hunting hypotheses, IOC sweeps, and anomaly detection across telemetry.

Community
Advanced
daemon-blockint-techdaemon-blockint-tech
7

threat-hunter

Validate adversary hypotheses across enterprise telemetry using MITRE ATT&CK mapping.

Community
Advanced
4lerman4lerman

threat-detection

Score hunting hypotheses against MITRE ATT&CK techniques and IOC data.

Community
Advanced
AdawoduAdawodu

engineering-threat-detection-engineer

Automate Sigma SIEM rule creation, MITRE ATT&CK mapping, and detection-as-code pipelines.

Community
Advanced