detection-engineer

What problem does it solve?

Create detection rules and hunting queries from malware analysis findings to drive rapid, accurate detection across SIEMs, IDS/IPS, and threat hunting workflows.

Core Features & Use Cases

• Sigma rule generation for SIEM detection across platforms (Splunk, Elastic, QRadar)
• Suricata/NIDS rule creation for network visibility
• Defanging IOCs for safe sharing and interoperability
• Hunting queries and reporting to operationalize findings for SOC teams
• Format conversion of IOCs and detections (STIX, OpenIOC, CSV) with confidence and volatility assessment

Quick Start

Use this skill to convert a malware analysis finding into Sigma and Suricata rules, generate hunting queries, and export IOCs in standard formats for SOC deployment.