detection-reviewer

What problem does it solve?

This Skill addresses the critical need for rigorous quality assurance in security detection rules, ensuring their accuracy, effectiveness, and operational readiness before deployment.

Core Features & Use Cases

• Comprehensive Rule Validation: Performs multi-stage checks on detection rules, covering structure, logic, threat intelligence mapping, false positive risk, test coverage, and operational impact.
• Multi-Format Support: Works with rules in SPL, KQL, Sigma, and Elastic formats.
• Use Case: A security engineer needs to review a newly developed Splunk detection rule for a critical MITRE ATT&CK technique. They use this Skill to ensure the rule is performant, accurate, has adequate test coverage, and clearly documented investigation steps.

Quick Start

Use the detection-reviewer skill to validate the attached Splunk detection rule file 'suspicious_process_creation.spl'.