building-detection-rules-with-sigma
From the author
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
Install
npx skills add 26zl/cybersec-toolkit --skill building-detection-rules-with-sigma -a claude-code
Installs to .claude/skills/building-detection-rules-with-sigma/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- siem-ruletonone-ai/tononeWrite SIEM detection rules for a threat or TTP — SIGMA format, MITRE mapping, and test cases. Use when asked to "write a SIGMA rule", "build a detection rule for this TTP", or "map a SIEM rule to MITRE".Testing★ 76
- siem-rulesUnitOneAI/SecuritySkillsGuides development of SIEM detection rules using KQL (Microsoft Sentinel) and SPL (Splunk) query languages, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user needs to write SIEM queries, tune alert thresholds, build correlation rules, or manage the detection rule lifecycle. Produces production-ready queries with detection logic patterns, threshold tuning guidance, and lifecycle management.Writing★ 94
- detection-engineeringgensecaihq/Wazuh-AutopilotDesign, backtest and tune detections as code — ADS-documented Sigma or Wazuh rules with ATT&CK coverage — and submit them via propose_detection for human review; use for detection gaps, recurring false positives or new TTPs from hunts and incidents.Design★ 60
- security-detection-rule-managementelastic/agent-skillsCreate, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.OfficialSecurity★ 600
- 12-log-analysisMasriyan/Claude-Code-CyberSecurity-SkillSecurity log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft SentinelSecurity★ 512
- detection-engineergl0bal01/malware-analysis-claude-skillsCreate detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.Security★ 54
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in