sigma-hunting

What problem does it solve?

This Skill automates the process of applying Sigma detection rules against log sources to identify potential threat activity, saving significant time and effort in threat hunting.

Core Features & Use Cases

• Sigma Rule Application: Executes Sigma rules against various log sources (journald, flat files, Elasticsearch, Splunk).
• Rule Conversion: Translates Sigma rules into backend-specific queries (Elasticsearch, Splunk, grep).
• Threat Triage: Reports matches, ATT&CK technique context, and flags coverage gaps.
• Use Case: Run a comprehensive threat hunt across your system logs for specific MITRE ATT&CK techniques like T1059 (Command and Scripting Interpreter).

Quick Start

Run a full sigma hunt against local logs.