engineering-threat-detection-engineer

What problem does it solve?

This Skill addresses the critical need for robust security detection capabilities by automating the creation, mapping, and tuning of SIEM rules and threat hunting playbooks. It aims to reduce alert noise and improve the detection of advanced threats.

Core Features & Use Cases

• SIEM Rule Development: Write and compile detection rules in vendor-agnostic Sigma format for various SIEMs (Splunk, Sentinel, Elastic).
• MITRE ATT&CK Mapping: Assess and identify gaps in detection coverage against the MITRE ATT&CK framework.
• Threat Hunting: Develop and execute structured threat hunts to find threats missed by automated detections.
• Detection-as-Code: Implement CI/CD pipelines for version-controlled, tested, and deployed detection rules.
• Use Case: A security operations team can use this Skill to automatically generate detection rules for newly identified adversary TTPs, map them to MITRE ATT&CK, and deploy them to their SIEM within hours, significantly reducing their mean time to detect.

Quick Start

Use the engineering-threat-detection-engineer skill to generate a Sigma rule for detecting suspicious PowerShell encoded command execution.