What problem does it solve? Security teams need periodic documentation of detection rule coverage, alert volume, and true/false positive rates, but manually compiling rule definitions, SIEM alert history, and SOAR case context into a consistent report is slow and error-prone. ## Core Features & Use Cases - Rule and Performance Retrieval: Pulls rule definitions via secops-mcp list_security_rules and historical alert statistics via get_security_alerts over a configurable timeframe (default 90 days). - SOAR Context Integration: Optionally enriches the report with related case details and tuning notes from secops-soar when a case ID is provided. - Standardized Markdown Output: Structures findings into a report template with rule details, performance metrics, and recommendations, plus a Mermaid sequence diagram, saved via write_to_file. - Use Case: A detection engineer needs a quarterly review of a noisy YARA-L rule; the skill gathers 90 days of alert data, correlates a tuning case, and writes detection_report_<RULE_ID>_<timestamp>.md. ## Quick Start Generate a detection report for rule RULE_ID covering the last 90 days of alerts and save it as a Markdown file.
