detection-yaml-engineer

What problem does it solve?

This Skill streamlines the creation and validation of security detection rules across multiple SIEM platforms, ensuring consistency, compliance, and optimal performance.

Core Features & Use Cases

• Multi-Platform Rule Generation: Creates detection rules in YAML (Splunk), Sigma, TOML (Elastic), and KQL (Sentinel) formats.
• Validation Assistance: Provides guidance on common mistakes and validation commands for each platform.
• Use Case: A security analyst needs to create a new detection rule for a specific MITRE ATT&CK technique. They can use this Skill to generate a template in their target SIEM's format, ensuring it adheres to repository standards and includes necessary metadata like MITRE mappings and test cases.

Quick Start

Use the detection-yaml-engineer skill to generate a Splunk security_content YAML template for the MITRE technique T1059.001.