detection-engineering
From the author
Design, backtest and tune detections as code — ADS-documented Sigma or Wazuh rules with ATT&CK coverage — and submit them via propose_detection for human review; use for detection gaps, recurring false positives or new TTPs from hunts and incidents.
Install
npx skills add gensecaihq/Wazuh-Autopilot --skill detection-engineering -a claude-code
Installs to .claude/skills/detection-engineering/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 80
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- blue-detecttonone-ai/tononeDesign detection rules for a threat — SIEM queries, alert logic, and MITRE ATT&CK mapping. Use when asked to "write a detection rule", "how do we detect this attack", or "build a SIEM query for this TTP".Design★ 76
- detection-and-monitoringcbrock84/headcountBuilds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detections that fire on attacker behavior rather than on individual events, tuning out the noise that trains people to ignore alerts, and defining what happens when something fires. Use this to design or assess monitoring coverage, work out why an incident went unnoticed, cut alert volume without losing signal, or decide what a detection capability should cost.Design★ 2.1K
- threat-huntingcoco-research/cocoUse for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.Design★ 787
- systematic-debuggingmvschwarz/openrigUse when encountering any bug, test failure, or unexpected behavior, before proposing fixesEngineering★ 8.2K
- hunt-assesstonone-ai/tononeDesign a compromise assessment — hunting scope, methodology, and evidence collection. Use when asked "are we compromised", "run a compromise assessment", or "scope a threat hunt".Design★ 76
- tune-recontonone-ai/tononeAudit existing fine-tuning or prompt engineering work — find quality gaps and optimization opportunities. Use when asked to "audit our fine-tuning work", "find prompt engineering gaps", or "look for optimization opportunities".Other★ 76
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in