cti-detection-engineer

What problem does it solve?

This Skill empowers users to create high-fidelity, intelligence-driven security detections that focus on adversary behaviors rather than easily changed indicators.

Core Features & Use Cases

• Behavioral Analysis: Decomposes complex attacks into atomic behaviors for detection.
• MITRE ATT&CK Mapping: Ensures detections are precisely mapped to the latest ATT&CK techniques and sub-techniques.
• Multi-SIEM Compatibility: Generates detection logic applicable across Splunk, Sentinel, Elastic, and Sigma.
• Use Case: Analyze a threat report, identify key adversary behaviors, map them to MITRE ATT&CK, and generate detection logic for your SIEM.

Quick Start

Use the cti-detection-engineer skill to analyze threat intelligence and generate a detection for MITRE ATT&CK technique T1003.001.