skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

detection-engineering

Converts validated hunting queries into production detection rules across SIEM and EDR platforms.

Updated Jun 24, 2026
Search Tags:#threat hunting#detection rules#siem#kql#edr#mitre att&ck#detection engineering
One-click install
npx skills add https://github.com/opentidehq/skills --skill detection-engineering-opentidehq
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/opentidehq/skills/tree/main/skills/detection-engineering
Command: npx skills add https://github.com/opentidehq/skills --skill detection-engineering-opentidehq

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Turning a validated threat hunt into a production detection rule is error-prone: false positives erode analyst trust, platforms impose different mandatory columns and NRT constraints, and multi-platform deployments drift out of parity. This Skill encodes the full detection engineering lifecycle so hunts become reliable, well-documented detection rules. ## Core Features & Use Cases - Hunt-to-Rule Conversion: A 7-step process covering time-filter adjustment, required output columns, FP reduction with justified exclusions, entity mapping, conservative response actions, and NRT constraint handling. - OpenTide Lifecycle Sequencing: Governs the TVM → DOM → MDR object flow with PR scope discipline and maturity progression from THEORETICAL to tuned production rules. - Multi-Platform Parity: A capability matrix and parity checklist for Microsoft Sentinel, Defender, Splunk, CrowdStrike, SentinelOne, Carbon Black, and HarfangLab deployments. - Use Case: After validating a KQL hunt in Microsoft Sentinel, use this Skill to convert it into a scheduled analytic rule with entity mappings, documented FP exclusions, and alert-only response actions, then mirror it as a Splunk correlation search. ## Quick Start Ask the agent to convert my validated hunting query into a production detection rule for Microsoft Sentinel following the 7-step conversion process.

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert a hunting query into a production detection rule?▼

Follow the 7-step conversion process: adjust the time filter to the platform schedule, add required output columns, exclude documented false positives, test with the production lookback, map entities, set conservative response actions, and verify NRT constraints. The hunt must have VALIDATED status first.

What is the difference between a hunting query and a detection rule?▼

Hunting queries run ad-hoc for retroactive investigation with flexible output and some FP tolerance. Detection rules run continuously on a schedule, require mandatory output columns for alert generation and entity mapping, and demand a low false-positive rate.

Does this detection process work with both Microsoft Sentinel and Splunk?▼

Yes, the Skill covers multi-platform deployment with a parity checklist for Sentinel, Defender, Splunk, CrowdStrike, SentinelOne, Carbon Black, and HarfangLab. Each platform binding must independently validate, and divergences like missing NRT support are documented explicitly.

When should a detection rule use automated containment response actions?▼

Only after the rule reaches production maturity with a proven low false-positive rate. Initial deployments should use alert-only or investigate actions, then escalate to enrichment and finally automated containment for high-confidence, critical-severity rules.

What are the limitations of near-real-time detection rules?▼

NRT rules commonly restrict table scope to a single data source, prohibit complex queries and inline comments, require removal of explicit time filters, and face platform rule quotas. Verify the data source supports NRT and test latency before deployment.

Related Skills

Explore More Software Engineering Skills→
dstreefkerkdstreefkerk
4

kql-expert

Optimizes and validates Kusto Query Language queries for Microsoft Sentinel and Azure Monitor.

Community
Advanced
xalgordxalgord
954

implementing-alert-fatigue-reduction

Reduces SOC alert fatigue by tuning detection rules and implementing risk-based alerting in Splunk ES.

Community
Advanced
OpenTideHQOpenTideHQ

mitre-attack

Maps adversary behaviors to MITRE ATT&CK techniques for detection engineering objects.

Official
Advanced
riparinoriparino
1

defensive-detection-engineering

Automates Sigma rule development, validation, and deployment with MITRE Navigator mapping and FP tuning for SIEM pipelines.

Community
Advanced