siem-rule

What this skill does

Guides the full lifecycle of a SIEM detection rule: define the threat objective, identify required log sources, write a platform-agnostic Sigma rule, convert it to Splunk SPL, Elastic KQL/EQL, and Microsoft Sentinel KQL, validate against test data, and document tuning recommendations. Covers endpoint, network, identity, and cloud detection categories.

When to use

• Building new detections from a threat model, IOC, or observed TTP
• Converting an existing Sigma rule to a platform-specific query
• Auditing existing rules for performance, fidelity, or coverage gaps
• Responding to a new CVE or threat actor report and needing a fast rule
• Reducing alert fatigue by tuning false-positive-heavy detections

Prerequisites

• sigma-cli for rule conversion: pip install sigma-cli
• Sigma backends: sigma plugin install splunk elastic-lucene microsoft365defender
• python3 for validation and formatting helpers
• jq for JSON manipulation: sudo apt install jq
• Access to at least one SIEM platform (Splunk / Elastic / Sentinel) or sample log data