Agent skill · security · aiskillstore
detection-sigma
Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.
Why this skill is useful
Provides domain-specific knowledge for creating and managing Sigma detection rules across multiple SIEM platforms, which the AI wouldn't reliably generate on its own.
What it needs
Requires pysigma, pysigma-backend-elasticsearch, pysigma-backend-splunk, python, pyyaml installed locally. About 7k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Sigma Detection Engineering Overview Sigma is to log detection what Snort is to network traffic and YARA is to files - a universal signature format for describing security-relevant log events. This skill helps create, validate, and convert Sigma rules for deployment across multiple SIEM platforms, enabling detection-as-code workflows. Core capabilities: Create detection rules using Sigma format Convert rules to 25+ SIEM/EDR backends (Splunk, Elastic, QRadar, Sentinel, etc.) Validate rule syntax and logic Map detections to MITRE ATT&CK framework Build threat hunting queries Implement compliance-based monitoring Quick Start Install Dependencies Create a Basic Sigma Rule Convert Rule to Target SIEM Core Workflows Workflow 1: Detection Rule Development Progress: [ ] 1. Identify detection requirement from threat intelligence or compliance [ ] 2. Research log sources and field mappings for target environment [ ] 3. Create Sigma rule using standard template [ ] 4. Validate rule syntax: python scripts/sigmavalidate.py rule.yml [ ] 5. Test rule against sample logs or historical data [ ] 6. Convert to target SIEM format [ ] 7. Deploy and tune based on false positive rate [ ] 8. Document rule metadata and MITRE ATT&CK mapping Work through each step systematically. Check off completed items. Workflow 2: Threat Hunting Rule Creation For proactive threat hunting based on TTPs: 1. Select MITRE ATT&CK Technique Review threat intelligence for relevant TTPs Identify technique ID (e.g., T1059.001 - PowerShell) See references/mitre-attack-mapping.md for common techniques 2. Identify Log Sources Determine which logs capture the technique Map log source categories (processcreation, networkconnection, fileevent) Verify log source availability in your environment 3. Define Detection Logic Create selection criteria matching suspicious patterns Add filters to reduce false positives Use field modifiers for robust matching (endswith, contains, re) 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/detection-sigma