threat-detection-engineer

What problem does it solve?

This Skill empowers security operations teams to build, deploy, and maintain effective threat detection capabilities, reducing dwell time and minimizing the impact of security incidents.

Core Features & Use Cases

• SIEM Rule Development: Write and compile detection rules in Sigma for various SIEM platforms.
• MITRE ATT&CK Mapping: Assess and improve coverage against the MITRE ATT&CK framework.
• Threat Hunting: Develop and execute structured threat hunts to find undetected threats.
• Detection-as-Code: Implement CI/CD pipelines for automated rule testing and deployment.
• Use Case: A security analyst needs to create a new detection rule for a recently disclosed APT technique. They can use this Skill to generate a Sigma rule, map it to MITRE ATT&CK, test it, and deploy it to their SIEM.

Quick Start

Use the threat-detection-engineer skill to write a Sigma rule for detecting suspicious PowerShell encoded command execution.