opensearch-detection-engineer
Installation
SKILL.md
OpenSearch Detection Engineering
Methodology for authoring and validating SIEM detections on OpenSearch Security Analytics: SIGMA rules, query DSL translation, MITRE ATT&CK mapping, anomaly detection, correlation, and SOC incident escalation. Vendor-neutral framework with OpenSearch-specific API patterns.
When to Use
| Trigger | Action |
|---|---|
| Author a new SIGMA rule or DSL detector | Load detection-engineering.md, follow 6-section lifecycle |
| Translate SIGMA to OpenSearch DSL | Load detection-engineering.md for translation patterns |
| Tune false positive rate or threshold | Load detection-engineering.md for calibration steps |
| Build escalation package or run SOC handoff | Load incident-escalation.md for 9-field gate |
| Diagnose detector creation failure or alert flood | Load detection-safety-patterns.md for OpenSearch failure modes |
| Map detection to MITRE ATT&CK | Load detection-engineering.md for tactic/technique catalog |