opensearch-detection-engineer
SolidOpenSearch detection engineering: SIGMA authoring, query DSL translation, MITRE ATT&CK mapping, anomaly detection, correlation rules, SOC incident escalation. Use for SIEM detection authoring, threshold tuning, alert validation, and Tier-1/Tier-2 escalation workflows.
Install
Quality Score: 93/100
Skill Content
Details
- Author
- notque
- Repository
- notque/vexjoy-agent
- Created
- 2 months ago
- Last Updated
- today
- Language
- Python
- License
- MIT
Similar Skills
Semantically similar based on skill content — not just same category
implementing-siem-use-cases-for-detection
Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
alert-prioritization
Analyzes SIEM alert pipelines for rule optimization, alert fatigue reduction, criticality scoring, asset-based prioritization, and correlation rule design using NIST CSF and detection engineering principles. USE THIS SKILL WHEN: - Your SOC team is drowning in alerts and you need to reduce noise - Someone asks about alert fatigue, false positive rates, or SIEM tuning - You need to design or evaluate an alert criticality scoring framework - A project involves SIEM rules (Splunk, Elastic, Sentinel, Chronicle, QRadar) - You are building or reviewing detection-as-code pipelines - Someone mentions MITRE ATT&CK coverage gaps or detection engineering - You need to optimize correlation rules or SOAR playbook coverage - Alert-to-incident conversion rates are below 30% - Analysts are bulk-closing alerts or MTTA is trending upward TRIGGER PHRASES: "alert fatigue", "SIEM tuning", "detection rules", "alert prioritization", "false positive rate", "correlation rules", "SOC optimization", "alert scoring", "detection engineeri
building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
detection-sigma
Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.