[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EK1Q4FFZDR7JAND09PPR9Q":3,"skill-same:01M6EK1Q4FFZDR7JAND09PPR9Q":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":6,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6EK1Q4FFZDR7JAND09PPR9Q","detection-sigma",null,"Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"detection sigma","sigma","detection","elasticsearch","siem rule","io","creation","across","incident","log","log analysis","analysis","siem","detection-engineering","log-analysis","splunk","MITRE-ATT&CK","mitre-attack","monitoring","code","2026-11-10 10:12:30",false,"---\nname: detection-sigma\ndescription: >\n  Generic detection rule creation and management using Sigma, the universal SIEM rule format.\n  Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms.\n  Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between\n  SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized\n  detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to\n  MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.\nversion: 0.1.0\nmaintainer: SirAppSec\ncategory: incident-response\ntags: [sigma, detection, siem, threat-hunting, mitre-attack, detection-engineering, log-analysis]\nframeworks: [MITRE-ATT&CK, NIST, ISO27001]\ndependencies:\n  python: \">=3.8\"\n  packages: [pysigma, pysigma-backend-splunk, pysigma-backend-elasticsearch, pyyaml]\nreferences:\n  - https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma\n  - https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002FpySigma\n  - https:\u002F\u002Fsigmahq.io\u002F\n---\n\n# Sigma Detection Engineering\n\n## Overview\n\nSigma is to log detection what Snort is to network traffic and YARA is to files - a universal signature format for describing security-relevant log events. This skill helps create, validate, and convert Sigma rules for deployment across multiple SIEM platforms, enabling detection-as-code workflows.\n\n**Core capabilities**:\n- Create detection rules using Sigma format\n- Convert rules to 25+ SIEM\u002FEDR backends (Splunk, Elastic, QRadar, Sentinel, etc.)\n- Validate rule syntax and logic\n- Map detections to MITRE ATT&CK framework\n- Build threat hunting queries\n- Implement compliance-based monitoring\n\n## Quick Start\n\n### Install Dependencies\n\n```bash\npip install pysigma pysigma-backend-splunk pysigma-backend-elasticsearch pyyaml\n```\n\n### Create a Basic Sigma Rule\n\n```yaml\ntitle: Suspicious PowerShell Execution\nid: 7d6d30b8-5b91-4b90-a71e-4f5a3f5a3c3f\nstatus: experimental\ndescription: Detects suspicious PowerShell execution with encoded commands\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F001\u002F\nauthor: Your Name\ndate: YYYY\u002FMM\u002FDD\nmodified: YYYY\u002FMM\u002FDD\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains:\n            - '-enc'\n            - '-EncodedCommand'\n            - 'FromBase64String'\n    condition: selection\nfalsepositives:\n    - Legitimate administrative scripts\nlevel: medium\n```\n\n### Convert Rule to Target SIEM\n\n```bash\n# Convert to Splunk\npython scripts\u002Fsigma_convert.py rule.yml --backend splunk\n\n# Convert to Elasticsearch\npython scripts\u002Fsigma_convert.py rule.yml --backend elasticsearch\n\n# Convert to Microsoft Sentinel\npython scripts\u002Fsigma_convert.py rule.yml --backend sentinel\n```\n\n## Core Workflows\n\n### Workflow 1: Detection Rule Development\n\nProgress:\n[ ] 1. Identify detection requirement from threat intelligence or compliance\n[ ] 2. Research log sources and field mappings for target environment\n[ ] 3. Create Sigma rule using standard template\n[ ] 4. Validate rule syntax: `python scripts\u002Fsigma_validate.py rule.yml`\n[ ] 5. Test rule against sample logs or historical data\n[ ] 6. Convert to target SIEM format\n[ ] 7. Deploy and tune based on false positive rate\n[ ] 8. Document rule metadata and MITRE ATT&CK mapping\n\nWork through each step systematically. Check off completed items.\n\n### Workflow 2: Threat Hunting Rule Creation\n\nFor proactive threat hunting based on TTPs:\n\n1. **Select MITRE ATT&CK Technique**\n   - Review threat intelligence for relevant TTPs\n   - Identify technique ID (e.g., T1059.001 - PowerShell)\n   - See [references\u002Fmitre-attack-mapping.md](references\u002Fmitre-attack-mapping.md) for common techniques\n\n2. **Identify Log Sources**\n   - Determine which logs capture the technique\n   - Map log source categories (process_creation, network_connection, file_event)\n   - Verify log source availability in your environment\n\n3. **Define Detection Logic**\n   - Create selection criteria matching suspicious patterns\n   - Add filters to reduce false positives\n   - Use field modifiers for robust matching (endswith, contains, re)\n\n4. **Validate and Test**\n   - Run validation: `python scripts\u002Fsigma_validate.py hunting-rule.yml`\n   - Test against known-good and known-bad samples\n   - Tune detection logic based on results\n\n5. **Document and Deploy**\n   - Add references to threat reports\n   - Document false positive scenarios\n   - Convert and deploy to production SIEM\n\n### Workflow 3: Bulk Rule Conversion\n\nWhen migrating between SIEM platforms:\n\n```bash\n# Validate all rules first\npython scripts\u002Fsigma_validate.py --directory rules\u002F --report validation-report.json\n\n# Convert entire rule set\npython scripts\u002Fsigma_convert.py --directory rules\u002F --backend splunk --output converted\u002F\n\n# Generate deployment report\npython scripts\u002Fsigma_convert.py --directory rules\u002F --backend splunk --report conversion-report.md\n```\n\nReview conversion report for:\n- Successfully converted rules\n- Rules requiring manual adjustment\n- Unsupported field mappings\n- Backend-specific limitations\n\n### Workflow 4: Compliance-Based Detection\n\nFor implementing compliance monitoring (PCI-DSS, NIST, ISO 27001):\n\n1. **Map Requirements to Detections**\n   - Identify compliance control requirements\n   - Determine required log monitoring\n   - See [references\u002Fcompliance-mappings.md](references\u002Fcompliance-mappings.md)\n\n2. **Create Detection Rules**\n   - Use compliance rule templates from `assets\u002Fcompliance-rules\u002F`\n   - Tag rules with compliance framework (e.g., tags: [pci-dss.10.2.5])\n   - Set appropriate severity levels\n\n3. **Validate Coverage**\n   - Run: `python scripts\u002Fcompliance_coverage.py --framework pci-dss`\n   - Review coverage gaps\n   - Create additional rules as needed\n\n4. **Generate Compliance Report**\n   - Document detection coverage by control\n   - Include sample queries and expected alerts\n   - Maintain audit trail for compliance evidence\n\n## Rule Structure Reference\n\n### Required Fields\n\n```yaml\ntitle: Human-readable rule name\nid: UUID (generate with: python -c \"import uuid; print(uuid.uuid4())\")\nstatus: stable|test|experimental|deprecated\ndescription: Detailed description of what this detects\nauthor: Your Name\ndate: YYYY\u002FMM\u002FDD\nmodified: YYYY\u002FMM\u002FDD\nlogsource:\n    category: process_creation|network_connection|file_event|...\n    product: windows|linux|macos|azure|aws|...\ndetection:\n    selection:\n        FieldName: value\n    condition: selection\nlevel: informational|low|medium|high|critical\n```\n\n### Optional Fields\n\n```yaml\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F\ntags:\n    - attack.execution\n    - attack.t1059.001\nfalsepositives:\n    - Legitimate use cases\nfields:\n    - CommandLine\n    - User\n    - ParentImage\n```\n\n### Detection Conditions\n\n```yaml\n# Simple selection\ndetection:\n    selection:\n        Field: value\n    condition: selection\n\n# Multiple conditions (AND)\ndetection:\n    selection:\n        Field1: value1\n        Field2: value2\n    condition: selection\n\n# OR conditions\ndetection:\n    selection1:\n        Field: value1\n    selection2:\n        Field: value2\n    condition: selection1 or selection2\n\n# NOT conditions\ndetection:\n    selection:\n        Field: suspicious_value\n    filter:\n        Field: legitimate_value\n    condition: selection and not filter\n\n# Complex logic\ndetection:\n    selection:\n        EventID: 4688\n    suspicious_cmd:\n        CommandLine|contains:\n            - 'powershell'\n            - 'cmd.exe'\n    filter_legitimate:\n        ParentImage|endswith: '\\explorer.exe'\n    condition: selection and suspicious_cmd and not filter_legitimate\n```\n\n### Field Modifiers\n\nCommon modifiers for flexible matching:\n\n- `|contains` - Contains substring (case-insensitive)\n- `|endswith` - Ends with string\n- `|startswith` - Starts with string\n- `|re` - Regular expression match\n- `|all` - All values must match\n- `|base64` - Base64-encoded value matching\n- `|base64offset` - Base64 with offset variations\n\nExample:\n```yaml\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'powershell'\n            - '-enc'\n        Image|endswith: '\\powershell.exe'\n```\n\n## Security Considerations\n\n- **Sensitive Data Handling**: Sigma rules may reference sensitive field names or patterns. Store rules in version control with appropriate access controls. Avoid including actual sensitive data in example values.\n\n- **Access Control**: Detection rules reveal defensive capabilities to adversaries. Implement role-based access for rule repositories. Limit rule modification to authorized detection engineers.\n\n- **Audit Logging**: Log all rule deployments, modifications, and deletions. Track who deployed which rules to which systems. Maintain change history for compliance auditing.\n\n- **Compliance**: Sigma rules support compliance monitoring (PCI-DSS 10.2, NIST SP 800-53 AU family, ISO 27001 A.12.4). Document rule-to-control mappings for audit evidence.\n\n- **Safe Defaults**: Use conservative false positive filtering in production. Start rules at \"experimental\" status. Test thoroughly in test environment before production deployment.\n\n## Bundled Resources\n\n### Scripts\n\n- `scripts\u002Fsigma_convert.py` - Convert Sigma rules to target SIEM backend formats\n- `scripts\u002Fsigma_validate.py` - Validate Sigma rule syntax and detect common errors\n- `scripts\u002Fcompliance_coverage.py` - Analyze detection coverage for compliance frameworks\n- `scripts\u002Fgenerate_rule_template.py` - Generate Sigma rule template with MITRE ATT&CK tags\n\n### References\n\n- `references\u002Fmitre-attack-mapping.md` - Common MITRE ATT&CK techniques and Sigma detection patterns\n- `references\u002Flog-source-guide.md` - Log source categories, products, and field mappings\n- `references\u002Fcompliance-mappings.md` - Compliance framework to detection rule mappings\n- `references\u002Fbackend-support.md` - Supported SIEM backends and conversion capabilities\n- `references\u002Ffield-modifiers.md` - Comprehensive guide to Sigma field modifiers and regex patterns\n\n### Assets\n\n- `assets\u002Frule-templates\u002F` - Pre-built Sigma rule templates for common attack patterns\n  - `lateral-movement.yml` - Lateral movement detection template\n  - `privilege-escalation.yml` - Privilege escalation detection template\n  - `persistence.yml` - Persistence mechanism detection template\n  - `credential-access.yml` - Credential dumping detection template\n\n- `assets\u002Fcompliance-rules\u002F` - Compliance-focused rule templates\n  - `pci-dss-monitoring.yml` - PCI-DSS monitoring requirements\n  - `nist-800-53-audit.yml` - NIST 800-53 audit logging requirements\n  - `iso27001-logging.yml` - ISO 27001 logging and monitoring\n\n## Common Detection Patterns\n\n### Pattern 1: Process Execution Monitoring\n\nDetect suspicious process creation with command-line analysis:\n\n```yaml\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\cmd.exe'\n        CommandLine|contains:\n            - 'Invoke-'\n            - 'IEX'\n            - 'FromBase64String'\n```\n\n### Pattern 2: Network Connection Monitoring\n\nDetect suspicious outbound connections:\n\n```yaml\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Initiated: 'true'\n        DestinationPort:\n            - 4444\n            - 5555\n            - 8080\n    filter:\n        DestinationIp|startswith:\n            - '10.'\n            - '172.16.'\n            - '192.168.'\n    condition: selection and not filter\n```\n\n### Pattern 3: File Event Monitoring\n\nDetect file creation in suspicious locations:\n\n```yaml\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|contains:\n            - '\\Windows\\Temp\\'\n            - '\\AppData\\Roaming\\'\n        TargetFilename|endswith:\n            - '.exe'\n            - '.dll'\n            - '.ps1'\n```\n\n## Integration Points\n\n### CI\u002FCD Integration\n\nBuild detection-as-code pipelines:\n\n```yaml\n# .github\u002Fworkflows\u002Fsigma-validation.yml\nname: Sigma Rule Validation\non: [push, pull_request]\njobs:\n  validate:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v2\n      - name: Validate Sigma Rules\n        run: |\n          pip install pysigma\n          python scripts\u002Fsigma_validate.py --directory rules\u002F\n      - name: Convert to Production Format\n        run: |\n          python scripts\u002Fsigma_convert.py --directory rules\u002F --backend splunk --output converted\u002F\n```\n\n### SIEM Deployment\n\nAutomated rule deployment:\n- Splunk: Use Splunk REST API or `splunk-sdk` for savedsearches\n- Elasticsearch: Convert to EQL and deploy via Kibana API\n- Microsoft Sentinel: Convert to KQL and deploy via Azure API\n- QRadar: Convert to AQL and deploy via QRadar API\n\nSee [references\u002Fbackend-support.md](references\u002Fbackend-support.md) for deployment examples.\n\n### Threat Intelligence Integration\n\nEnrich rules with threat intel:\n- Tag rules with threat actor TTPs\n- Reference threat reports and IOCs\n- Map to MITRE ATT&CK techniques\n- Track rule effectiveness against known threats\n\n## Troubleshooting\n\n### Issue: Conversion Fails for Specific Backend\n\n**Solution**: Check backend compatibility and field mappings. Some backends have limitations:\n- Review `references\u002Fbackend-support.md` for known limitations\n- Use `sigma_convert.py --backend \u003Cbackend> --debug` for detailed error output\n- Check if field names are supported in target backend\n- Consider custom pipeline transformations for unsupported fields\n\n### Issue: High False Positive Rate\n\n**Solution**: Refine detection logic with additional filters:\n1. Review false positive patterns\n2. Add exclusion filters for legitimate use cases\n3. Use more specific field modifiers (e.g., `|endswith` vs `|contains`)\n4. Consider time-based correlation for behavioral detection\n5. Test with historical data to validate tuning\n\n### Issue: Rule Not Triggering in Target SIEM\n\n**Solution**: Verify log source availability and field mappings:\n1. Confirm log source is ingested: Check SIEM data sources\n2. Verify field names match: Use `sigma_convert.py --show-fields` to see mapping\n3. Test converted query directly in SIEM\n4. Check for case sensitivity issues in field values\n5. Validate time window and search scope in SIEM\n\n## MITRE ATT&CK Integration\n\nTag rules with ATT&CK tactics and techniques:\n\n```yaml\ntags:\n    - attack.execution           # Tactic\n    - attack.t1059.001          # Technique: PowerShell\n    - attack.defense_evasion    # Additional tactic\n    - attack.t1027              # Technique: Obfuscated Files\n```\n\nCommon tactic tags:\n- `attack.initial_access`\n- `attack.execution`\n- `attack.persistence`\n- `attack.privilege_escalation`\n- `attack.defense_evasion`\n- `attack.credential_access`\n- `attack.discovery`\n- `attack.lateral_movement`\n- `attack.collection`\n- `attack.exfiltration`\n- `attack.command_and_control`\n- `attack.impact`\n\nFor detailed technique mappings, see [references\u002Fmitre-attack-mapping.md](references\u002Fmitre-attack-mapping.md).\n\n## Best Practices\n\n1. **Start with Community Rules**: Use SigmaHQ repository (3000+ peer-reviewed rules) as foundation\n2. **Version Control**: Store rules in Git with meaningful commit messages\n3. **Test Before Deploy**: Validate against historical data in test environment\n4. **Document Tuning**: Track false positive patterns and tuning decisions\n5. **Map to Frameworks**: Tag all rules with MITRE ATT&CK and compliance mappings\n6. **Automate Validation**: Use CI\u002FCD to validate rules on every change\n7. **Monitor Effectiveness**: Track rule trigger rates and true positive rates\n8. **Regular Updates**: Review and update rules based on new threat intelligence\n\n## References\n\n- [Sigma Specification](https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma-specification)\n- [SigmaHQ Rule Repository](https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma\u002Ftree\u002Fmaster\u002Frules)\n- [pySigma Documentation](https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002FpySigma)\n- [Sigma Converter Web Tool](https:\u002F\u002Fsigconverter.io\u002F)\n- [MITRE ATT&CK Framework](https:\u002F\u002Fattack.mitre.org\u002F)\n","# Sigma Detection Engineering\n\n## Overview\n\nSigma is to log detection what Snort is to network traffic and YARA is to files - a universal signature format for describing security-relevant log events. This skill helps create, validate, and convert Sigma rules for deployment across multiple SIEM platforms, enabling detection-as-code workflows.\n\n**Core capabilities**:\n- Create detection rules using Sigma format\n- Convert rules to 25+ SIEM\u002FEDR backends (Splunk, Elastic, QRadar, Sentinel, etc.)\n- Validate rule syntax and logic\n- Map detections to MITRE ATT&CK framework\n- Build threat hunting queries\n- Implement compliance-based monitoring\n\n## Quick Start\n\n### Install Dependencies\n\n```bash\npip install pysigma pysigma-backend-splunk pysigma-backend-elasticsearch pyyaml\n```\n\n### Create a Basic Sigma Rule\n\n```yaml\ntitle: Suspicious PowerShell Execution\nid: 7d6d30b8-5b91-4b90-a71e-4f5a3f5a3c3f\nstatus: experimental\ndescription: Detects suspicious PowerShell execution with encoded commands\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F001\u002F\nauthor: Your Name\ndate: YYYY\u002FMM\u002FDD\nmodified: YYYY\u002FMM\u002FDD\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains:\n            - '-enc'\n            - '-EncodedCommand'\n            - 'FromBase64String'\n    condition: selection\nfalsepositives:\n    - Legitimate administrative scripts\nlevel: medium\n```\n\n### Convert Rule to Target SIEM\n\n```bash\n# Convert to Splunk\npython scripts\u002Fsigma_convert.py rule.yml --backend splunk\n\n# Convert to Elasticsearch\npython scripts\u002Fsigma_convert.py rule.yml --backend elasticsearch\n\n# Convert to Microsoft Sentinel\npython scripts\u002Fsigma_convert.py rule.yml --backend sentinel\n```\n\n## Core Workflows\n\n### Workflow 1: Detection Rule Development\n\nProgress:\n[ ] 1. Identify detection requirement from threat intelligence or compliance\n[ ] 2. Research log sources and field mappings for target environment\n[ ] 3. Create Sigma rule using standard template\n[ ] 4. Validate rule syntax: `python scripts\u002Fsigma_validate.py rule.yml`\n[ ] 5. Test rule against sample logs or historical data\n[ ] 6. Convert to target SIEM format\n[ ] 7. Deploy and tune based on false positive rate\n[ ] 8. Document rule metadata and MITRE ATT&CK mapping\n\nWork through each step systematically. Check off completed items.\n\n### Workflow 2: Threat Hunting Rule Creation\n\nFor proactive threat hunting based on TTPs:\n\n1. **Select MITRE ATT&CK Technique**\n   - Review threat intelligence for relevant TTPs\n   - Identify technique ID (e.g., T1059.001 - PowerShell)\n   - See [references\u002Fmitre-attack-mapping.md](references\u002Fmitre-attack-mapping.md) for common techniques\n\n2. **Identify Log Sources**\n   - Determine which logs capture the technique\n   - Map log source categories (process_creation, network_connection, file_event)\n   - Verify log source availability in your environment\n\n3. **Define Detection Logic**\n   - Create selection criteria matching suspicious patterns\n   - Add filters to reduce false positives\n   - Use field modifiers for robust matching (endswith, contains, re)\n\n4. **Validate and Test**\n   - Run validation: `python scripts\u002Fsigma_validate.py hunting-rule.yml`\n   - Test against known-good and known-bad samples\n   - Tune detection logic based on results\n\n5. **Document and Deploy**\n   - Add references to threat reports\n   - Document false positive scenarios\n   - Convert and deploy to production SIEM\n\n### Workflow 3: Bulk Rule Conversion\n\nWhen migrating between SIEM platforms:\n\n```bash\n# Validate all rules first\npython scripts\u002Fsigma_validate.py --directory rules\u002F --report validation-report.json\n\n# Convert entire rule set\npython scripts\u002Fsigma_convert.py --directory rules\u002F --backend splunk --output converted\u002F\n\n# Generate deployment report\npython scripts\u002Fsigma_convert.py --directory rules\u002F --backend splunk --report conversion-report.md\n```\n\nReview conversion report for:\n- Successfully converted rules\n- Rules requiring manual adjustment\n- Unsupported field mappings\n- Backend-specific limitations\n\n### Workflow 4: Compliance-Based Detection\n\nFor implementing compliance monitoring (PCI-DSS, NIST, ISO 27001):\n\n1. **Map Requirements to Detections**\n   - Identify compliance control requirements\n   - Determine required log monitoring\n   - See [references\u002Fcompliance-mappings.md](references\u002Fcompliance-mappings.md)\n\n2. **Create Detection Rules**\n   - Use compliance rule templates from `assets\u002Fcompliance-rules\u002F`\n   - Tag rules with compliance framework (e.g., tags: [pci-dss.10.2.5])\n   - Set appropriate severity levels\n\n3. **Validate Coverage**\n   - Run: `python scripts\u002Fcompliance_coverage.py --framework pci-dss`\n   - Review coverage gaps\n   - Create additional rules as needed\n\n4. **Generate Compliance Report**\n   - Document detection coverage by control\n   - Include sample queries and expected alerts\n   - Maintain audit trail for compliance evidence\n\n## Rule Structure Reference\n\n### Required Fields\n\n```yaml\ntitle: Human-readable rule name\nid: UUID (generate with: python -c \"import uuid; print(uuid.uuid4())\")\nstatus: stable|test|experimental|deprecated\ndescription: Detailed description of what this detects\nauthor: Your Name\ndate: YYYY\u002FMM\u002FDD\nmodified: YYYY\u002FMM\u002FDD\nlogsource:\n    category: process_creation|network_connection|file_event|...\n    product: windows|linux|macos|azure|aws|...\ndetection:\n    selection:\n        FieldName: value\n    condition: selection\nlevel: informational|low|medium|high|critical\n```\n\n### Optional Fields\n\n```yaml\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F\ntags:\n    - attack.execution\n    - attack.t1059.001\nfalsepositives:\n    - Legitimate use cases\nfields:\n    - CommandLine\n    - User\n    - ParentImage\n```\n\n### Detection Conditions\n\n```yaml\n# Simple selection\ndetection:\n    selection:\n        Field: value\n    condition: selection\n\n# Multiple conditions (AND)\ndetection:\n    selection:\n        Field1: value1\n        Field2: value2\n    condition: selection\n\n# OR conditions\ndetection:\n    selection1:\n        Field: value1\n    selection2:\n        Field: value2\n    condition: selection1 or selection2\n\n# NOT conditions\ndetection:\n    selection:\n        Field: suspicious_value\n    filter:\n        Field: legitimate_value\n    condition: selection and not filter\n\n# Complex logic\ndetection:\n    selection:\n        EventID: 4688\n    suspicious_cmd:\n        CommandLine|contains:\n            - 'powershell'\n            - 'cmd.exe'\n    filter_legitimate:\n        ParentImage|endswith: '\\explorer.exe'\n    condition: selection and suspicious_cmd and not filter_legitimate\n```\n\n### Field Modifiers\n\nCommon modifiers for flexible matching:\n\n- `|contains` - Contains substring (case-insensitive)\n- `|endswith` - Ends with string\n- `|startswith` - Starts with string\n- `|re` - Regular expression match\n- `|all` - All values must match\n- `|base64` - Base64-encoded value matching\n- `|base64offset` - Base64 with offset variations\n\nExample:\n```yaml\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'powershell'\n            - '-enc'\n        Image|endswith: '\\powershell.exe'\n```\n\n## Security Considerations\n\n- **Sensitive Data Handling**: Sigma rules may reference sensitive field names or patterns. Store rules in version control with appropriate access controls. Avoid including actual sensitive data in example values.\n\n- **Access Control**: Detection rules reveal defensive capabilities to adversaries. Implement role-based access for rule repositories. Limit rule modification to authorized detection engineers.\n\n- **Audit Logging**: Log all rule deployments, modifications, and deletions. Track who deployed which rules to which systems. Maintain change history for compliance auditing.\n\n- **Compliance**: Sigma rules support compliance monitoring (PCI-DSS 10.2, NIST SP 800-53 AU family, ISO 27001 A.12.4). Document rule-to-control mappings for audit evidence.\n\n- **Safe Defaults**: Use conservative false positive filtering in production. Start rules at \"experimental\" status. Test thoroughly in test environment before production deployment.\n\n## Bundled Resources\n\n### Scripts\n\n- `scripts\u002Fsigma_convert.py` - Convert Sigma rules to target SIEM backend formats\n- `scripts\u002Fsigma_validate.py` - Validate Sigma rule syntax and detect common errors\n- `scripts\u002Fcompliance_coverage.py` - Analyze detection coverage for compliance frameworks\n- `scripts\u002Fgenerate_rule_template.py` - Generate Sigma rule template with MITRE ATT&CK tags\n\n### References\n\n- `references\u002Fmitre-attack-mapping.md` - Common MITRE ATT&CK techniques and Sigma detection patterns\n- `references\u002Flog-source-guide.md` - Log source categories, products, and field mappings\n- `references\u002Fcompliance-mappings.md` - Compliance framework to detection rule mappings\n- `references\u002Fbackend-support.md` - Supported SIEM backends and conversion capabilities\n- `references\u002Ffield-modifiers.md` - Comprehensive guide to Sigma field modifiers and regex patterns\n\n### Assets\n\n- `assets\u002Frule-templates\u002F` - Pre-built Sigma rule templates for common attack patterns\n  - `lateral-movement.yml` - Lateral movement detection template\n  - `privilege-escalation.yml` - Privilege escalation detection template\n  - `persistence.yml` - Persistence mechanism detection template\n  - `credential-access.yml` - Credential dumping detection template\n\n- `assets\u002Fcompliance-rules\u002F` - Compliance-focused rule templates\n  - `pci-dss-monitoring.yml` - PCI-DSS monitoring requirements\n  - `nist-800-53-audit.yml` - NIST 800-53 audit logging requirements\n  - `iso27001-logging.yml` - ISO 27001 logging and monitoring\n\n## Common Detection Patterns\n\n### Pattern 1: Process Execution Monitoring\n\nDetect suspicious process creation with command-line analysis:\n\n```yaml\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\cmd.exe'\n        CommandLine|contains:\n            - 'Invoke-'\n            - 'IEX'\n            - 'FromBase64String'\n```\n\n### Pattern 2: Network Connection Monitoring\n\nDetect suspicious outbound connections:\n\n```yaml\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Initiated: 'true'\n        DestinationPort:\n            - 4444\n            - 5555\n            - 8080\n    filter:\n        DestinationIp|startswith:\n            - '10.'\n            - '172.16.'\n            - '192.168.'\n    condition: selection and not filter\n```\n\n### Pattern 3: File Event Monitoring\n\nDetect file creation in suspicious locations:\n\n```yaml\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|contains:\n            - '\\Windows\\Temp\\'\n            - '\\AppData\\Roaming\\'\n        TargetFilename|endswith:\n            - '.exe'\n            - '.dll'\n            - '.ps1'\n```\n\n## Integration Points\n\n### CI\u002FCD Integration\n\nBuild detection-as-code pipelines:\n\n```yaml\n# .github\u002Fworkflows\u002Fsigma-validation.yml\nname: Sigma Rule Validation\non: [push, pull_request]\njobs:\n  validate:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v2\n      - name: Validate Sigma Rules\n        run: |\n          pip install pysigma\n          python scripts\u002Fsigma_validate.py --directory rules\u002F\n      - name: Convert to Production Format\n        run: |\n          python scripts\u002Fsigma_convert.py --directory rules\u002F --backend splunk --output converted\u002F\n```\n\n### SIEM Deployment\n\nAutomated rule deployment:\n- Splunk: Use Splunk REST API or `splunk-sdk` for savedsearches\n- Elasticsearch: Convert to EQL and deploy via Kibana API\n- Microsoft Sentinel: Convert to KQL and deploy via Azure API\n- QRadar: Convert to AQL and deploy via QRadar API\n\nSee [references\u002Fbackend-support.md](references\u002Fbackend-support.md) for deployment examples.\n\n### Threat Intelligence Integration\n\nEnrich rules with threat intel:\n- Tag rules with threat actor TTPs\n- Reference threat reports and IOCs\n- Map to MITRE ATT&CK techniques\n- Track rule effectiveness against known threats\n\n## Troubleshooting\n\n### Issue: Conversion Fails for Specific Backend\n\n**Solution**: Check backend compatibility and field mappings. Some backends have limitations:\n- Review `references\u002Fbackend-support.md` for known limitations\n- Use `sigma_convert.py --backend \u003Cbackend> --debug` for detailed error output\n- Check if field names are supported in target backend\n- Consider custom pipeline transformations for unsupported fields\n\n### Issue: High False Positive Rate\n\n**Solution**: Refine detection logic with additional filters:\n1. Review false positive patterns\n2. Add exclusion filters for legitimate use cases\n3. Use more specific field modifiers (e.g., `|endswith` vs `|contains`)\n4. Consider time-based correlation for behavioral detection\n5. Test with historical data to validate tuning\n\n### Issue: Rule Not Triggering in Target SIEM\n\n**Solution**: Verify log source availability and field mappings:\n1. Confirm log source is ingested: Check SIEM data sources\n2. Verify field names match: Use `sigma_convert.py --show-fields` to see mapping\n3. Test converted query directly in SIEM\n4. Check for case sensitivity issues in field values\n5. Validate time window and search scope in SIEM\n\n## MITRE ATT&CK Integration\n\nTag rules with ATT&CK tactics and techniques:\n\n```yaml\ntags:\n    - attack.execution           # Tactic\n    - attack.t1059.001          # Technique: PowerShell\n    - attack.defense_evasion    # Additional tactic\n    - attack.t1027              # Technique: Obfuscated Files\n```\n\nCommon tactic tags:\n- `attack.initial_access`\n- `attack.execution`\n- `attack.persistence`\n- `attack.privilege_escalation`\n- `attack.defense_evasion`\n- `attack.credential_access`\n- `attack.discovery`\n- `attack.lateral_movement`\n- `attack.collection`\n- `attack.exfiltration`\n- `attack.command_and_control`\n- `attack.impact`\n\nFor detailed technique mappings, see [references\u002Fmitre-attack-mapping.md](references\u002Fmitre-attack-mapping.md).\n\n## Best Practices\n\n1. **Start with Community Rules**: Use SigmaHQ repository (3000+ peer-reviewed rules) as foundation\n2. **Version Control**: Store rules in Git with meaningful commit messages\n3. **Test Before Deploy**: Validate against historical data in test environment\n4. **Document Tuning**: Track false positive patterns and tuning decisions\n5. **Map to Frameworks**: Tag all rules with MITRE ATT&CK and compliance mappings\n6. **Automate Validation**: Use CI\u002FCD to validate rules on every change\n7. **Monitor Effectiveness**: Track rule trigger rates and true positive rates\n8. **Regular Updates**: Review and update rules based on new threat intelligence\n\n## References\n\n- [Sigma Specification](https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma-specification)\n- [SigmaHQ Rule Repository](https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma\u002Ftree\u002Fmaster\u002Frules)\n- [pySigma Documentation](https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002FpySigma)\n- [Sigma Converter Web Tool](https:\u002F\u002Fsigconverter.io\u002F)\n- [MITRE ATT&CK Framework](https:\u002F\u002Fattack.mitre.org\u002F)\n",{"name":5,"tags":54,"version":56,"category":57,"frameworks":58,"maintainer":61,"references":62,"description":66,"dependencies":67},[30,31,41,55,46,42,43],"threat-hunting","0.1.0","incident-response",[45,59,60],"NIST","ISO27001","SirAppSec",[63,64,65],"https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma","https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002FpySigma","https:\u002F\u002Fsigmahq.io\u002F","Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.\n",{"python":68,"packages":69},">=3.8",[70,71,72,73],"pysigma","pysigma-backend-splunk","pysigma-backend-elasticsearch","pyyaml","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill detection-sigma",{"tool":89,"command":90},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill detection-sigma",{"tool":92,"command":93},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill detection-sigma","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002FSKILL.md",true,[97,103,107,111,115,119,123,127,133,137,141,145,149],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"assets\u002Fcompliance-rules\u002Fiso27001-logging.yml","ASSET","资产文件",3156,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Fcompliance-rules\u002Fiso27001-logging.yml",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"assets\u002Fcompliance-rules\u002Fnist-800-53-audit.yml",2918,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Fcompliance-rules\u002Fnist-800-53-audit.yml",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"assets\u002Fcompliance-rules\u002Fpci-dss-monitoring.yml",2399,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Fcompliance-rules\u002Fpci-dss-monitoring.yml",{"path":112,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":113,"sourceHtmlUrl":114},"assets\u002Frule-templates\u002Fcredential-access.yml",1800,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Frule-templates\u002Fcredential-access.yml",{"path":116,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":117,"sourceHtmlUrl":118},"assets\u002Frule-templates\u002Flateral-movement.yml",1814,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Frule-templates\u002Flateral-movement.yml",{"path":120,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":121,"sourceHtmlUrl":122},"assets\u002Frule-templates\u002Fpersistence.yml",1815,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Frule-templates\u002Fpersistence.yml",{"path":124,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":125,"sourceHtmlUrl":126},"assets\u002Frule-templates\u002Fprivilege-escalation.yml",1689,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fassets\u002Frule-templates\u002Fprivilege-escalation.yml",{"path":128,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fbackend-support.md","REFERENCE","参考文档",8487,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Freferences\u002Fbackend-support.md",{"path":134,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":135,"sourceHtmlUrl":136},"references\u002Fcompliance-mappings.md",7501,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Freferences\u002Fcompliance-mappings.md",{"path":138,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":139,"sourceHtmlUrl":140},"references\u002Ffield-modifiers.md",8572,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Freferences\u002Ffield-modifiers.md",{"path":142,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":143,"sourceHtmlUrl":144},"references\u002Flog-source-guide.md",6036,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Freferences\u002Flog-source-guide.md",{"path":146,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":147,"sourceHtmlUrl":148},"references\u002Fmitre-attack-mapping.md",7151,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Freferences\u002Fmitre-attack-mapping.md",{"path":150,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":151,"sourceHtmlUrl":152},"skill-report.json",81442,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fdetection-sigma\u002Fskill-report.json",[154,166,176,185,191,198],{"skillNo":155,"name":156,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":162,"publishedAt":49},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[159],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[163,164,165],"model","model hierarchy","model hierarchy skill",{"skillNo":167,"name":168,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":49},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[171],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},[173,174,175],"MCP","zoom","zoom mcp",{"skillNo":177,"name":178,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":49},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[182,183,184,174],"sdk","zoom apps sdk","apps",{"skillNo":186,"name":187,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":49},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[187],{"skillNo":192,"name":193,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":49},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[196],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},[193],{"skillNo":199,"name":200,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":49},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[200]]