opensearch-detection-engineer

Featured

OpenSearch SIEM detection: SIGMA, query DSL, MITRE ATT&CK mapping, anomaly/correlation rules, alert validation, SOC escalation.

AI & Automation 419 stars 44 forks Updated 2 days ago MIT

Install

View on GitHub

Quality Score: 95/100

Stars 20%
87
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# OpenSearch Detection Engineering Methodology for authoring and validating SIEM detections on OpenSearch Security Analytics: SIGMA rules, query DSL translation, MITRE ATT&CK mapping, anomaly detection, correlation, and SOC incident escalation. Vendor-neutral framework with OpenSearch-specific API patterns. ## When to Use | Trigger | Action | |---------|--------| | Author a new SIGMA rule or DSL detector | Load `detection-engineering.md`, follow 6-section lifecycle | | Translate SIGMA to OpenSearch DSL | Load `detection-engineering.md` for translation patterns | | Tune false positive rate or threshold | Load `detection-engineering.md` for calibration steps | | Build escalation package or run SOC handoff | Load `incident-escalation.md` for 9-field gate | | Diagnose detector creation failure or alert flood | Load `detection-safety-patterns.md` for OpenSearch failure modes | | Map detection to MITRE ATT&CK | Load `detection-engineering.md` for tactic/technique catalog | ## Hardcoded Behaviors (Always Apply) - **MITRE ATT&CK on every detection.** Include technique ID (e.g., `T1110.003`), tactic name (e.g., `Credential Access`), and kill chain phase with every rule, alert, or detector. Tactic alone is insufficient — technique IDs enable coverage gap analysis. - **Field-existence check before rule creation.** Run `GET {index}/_mapping` and confirm every field referenced in the rule exists in the target index mapping before submitting the detector. Absent fields cause silent fa...

Details

Author
notque
Repository
notque/vexjoy-agent
Created
5 months ago
Last Updated
2 days ago
Language
Python
License
MIT

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

defense-detection-sigma

Write portable detections as Sigma rules and map them to MITRE ATT&CK, then convert to your SIEM. Load for blue-team/detection-engineering tasks: "write a detection", "sigma rule", "alert on", turning an offensive technique or an incident into a repeatable detection.

16 Updated yesterday
NoorQureshi
Data & Documents Solid

detection-engineer

Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.

46 Updated 5 days ago
gl0bal01
AI & Automation Listed

sota-detection-engineering

State-of-the-art detection engineering, SOC, threat hunting, and incident response (2026). Use when BUILDING detective controls or SOC capability — Sigma/YARA/Falco/Tetragon/Suricata rules, detection-as-code, MITRE ATT&CK coverage, SIEM detections, alert triage and SOAR, threat hunts, threat-intel, deception, IR playbooks, or adversary emulation — AND when AUDITING detection & IR posture (can we detect this? does this alert fire?). Owns DETECTIVE controls, SOC workflow, hunting, and IR (sota-observability owns the telemetry pipeline). Trigger keywords: detection engineering, detection-as-code, Sigma, YARA, YARA-X, Falco, Tetragon, Suricata, SIEM, KQL, SPL, EQL, ATT&CK, Pyramid of Pain, threat hunting, threat intel, TIP, STIX, TAXII, IOC, IOA, TTP, SOC, alert fatigue, tuning, SOAR, runbook, incident response, IR playbook, NIST 800-61, PICERL, forensics, chain of custody, purple team, honeypot, honeytoken, canary, OCSF, MTTD, false positive, Active Directory, Kerberoasting, DCSync, golden ticket, ADCS, RBCD.

19 Updated today
martinholovsky