name: detection-engineering description: >- Detection engineering lifecycle management including detection-as-code frameworks, Sigma rule development, coverage analysis, behavioral detection models, testing frameworks, false positive analysis, log parsers, lifecycle management, gap remediation, threat-informed detections, metrics tracking, and rule optimization. domain: cybersecurity subdomain: detection-engineering tags:

• detection-as-code
• sigma-rules
• detection-coverage
• behavioral-detection
• detection-testing
• false-positive-analysis
• log-parsers
• detection-lifecycle
• gap-remediation
• threat-informed
• detection-metrics
• rule-optimization version: "1.0" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack:
  • T1059
  • T1003
  • T1053
  • T1055
  • T1021
  • T1078 nist-csf:
  • DE.AE-2
  • DE.AE-3
  • DE.CM-1
  • DE.CM-4
  • DE.DP-1 frameworks:
  • "Sigma"
  • "MITRE ATT&CK"
  • "DeTT&CT"

SKILL: Detection Engineering

When to Use

Activate this skill when the operator asks about:

• Detection-as-code — CI/CD pipelines for detection rules, version control, automated testing
• Sigma rule development — Writing, validating, and converting cross-SIEM detection rules
• Coverage analysis — Mapping detection coverage to ATT&CK matrix, identifying blind spots
• Behavioral detection — Building models for anomaly detection beyond signature matching
• Testing frameworks — Atomic Red Team, MITRE Caldera, detection validation
• False positive analysis — Systematic FP investigation, tuning, and documentation
• Log parsers — Custom parsing for non-standard log sources
• Lifecycle management — Detection rule states, ownership, review cadence, retirement
• Gap remediation — Prioritized detection gap closure using threat intelligence
• Threat-informed detections — Building detections from CTI reports and adversary emulation
• Metrics tracking — Detection efficacy, coverage, quality, and operational metrics
• Rule optimization — Performance tuning, query efficiency, resource reduction

Prerequisites

Quick Reference

Detection Rule Lifecycle

title: Suspicious Process Spawned by Office Application
id: 5e1c0d42-8a3f-4b2e-9c7d-1f6e8a3b4c5d
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\winword.exe'
      - '\\excel.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.execution
  - attack.t1059.001

Workflow

1. Detection Development

Author detection rules using detection-as-code principles. Version control, peer review, automated validation, and CI/CD deployment to SIEM platforms.

→ Deep reference: references/detection-development.md

• Detection-as-code pipeline architecture
• Sigma rule authoring best practices
• CI/CD integration for detection deployment
• Rule quality scoring and review checklist

2. Coverage Analysis & Gap Remediation

Map current detection coverage to MITRE ATT&CK matrix. Identify gaps using DeTT&CT and prioritize based on threat intelligence relevance.

→ Deep reference: references/coverage-analysis.md

• ATT&CK coverage heatmap generation
• DeTT&CT configuration and scoring
• Gap prioritization using CTI
• Coverage improvement tracking

3. Testing & Optimization

Validate detections using adversary emulation, tune for false positives, and optimize query performance for production SIEM workloads.

→ Deep reference: references/testing-optimization.md

• Atomic Red Team integration
• False positive investigation workflow
• Query performance optimization
• Detection efficacy measurement

Verification

References

• NIST Cybersecurity Framework
• MITRE ATT&CK
• ISO 27001:2022
• CIS Controls v8

v1.0 | Validated: 2026-03-18