[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71P76NQ2SYW368SP6NNN7D7":3,"skill-same:01M71P76NQ2SYW368SP6NNN7D7":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":48,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M71P76NQ2SYW368SP6NNN7D7","threat-detection",null,"Use when an org role acts as threat detection engineer and must build and tune SIEM rules, ATT&CK coverage mapping and threat hunts. Covers Sigma rules, behavioral over IOC detection and false-positive profiles. For mapping threats to controls see threat-mitigation-mapping.","monoes\u002Fmonomind","monoes","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F276744696?v=4","01M71KWF37AJ2NJBP3KWBVSDGT","01M71KWF4CSF8ADH0M6HA09VD2",23,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fthreat-detection\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"detection","threat detection","threat","observability","context","behavioral","mapping","org","security","sigma","false-positive","monomind","siem","query","when","false","impact","engineer","incident","coverage","2026-11-10 13:02:02",false,"---\nname: threat-detection\ndescription: \"Use when an org role acts as threat detection engineer and must build and tune SIEM rules, ATT&CK coverage mapping and threat hunts. Covers Sigma rules, behavioral over IOC detection and false-positive profiles. For mapping threats to controls see threat-mitigation-mapping.\"\ntags: [\"security\",\"observability\",\"incident\"]\ntools: [\"monograph_query\",\"monograph_context\",\"monograph_impact\"]\nlicense: Apache-2.0\nsource: https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\n---\n# Threat Detection — Best Practices\n\n## Focus\nBuilds and tunes the detection layer that catches attackers after they bypass preventive controls — SIEM rules, ATT&CK coverage mapping, and threat hunting that converts into automated detections.\n\n## Best practices\n- Map every detection rule to at least one MITRE ATT&CK technique — if you can't map it, you don't understand what it detects\n- Write rules in a vendor-agnostic format (Sigma) first, then compile to target SIEMs, so detection logic isn't locked to one platform\n- Prefer behavioral detections (process chains, anomalous sequences) over static IOC matching (IPs, hashes) — attackers rotate indicators daily\n- Document a false-positive profile for every rule before deployment — if you don't know what benign activity triggers it, it isn't tested\n- Prioritize coverage gaps by threat intelligence relevant to your actual environment\u002Findustry, not theoretical attacks from conference talks\n- Treat detection rules as code: version-controlled, peer-reviewed, tested against sample data, deployed via CI — never edited live in a console\n- Convert every successful threat hunt into an automated detection — manual discoveries that don't become rules will be missed next time\n\n## Common pitfalls\n- Deploying untested rules that either fire on everything or never fire at all\n- Chasing detection quantity over quality — a noisy SIEM trains analysts to ignore alerts, which is worse than no detection\n- Detecting only initial access and missing lateral movement, persistence, and exfiltration further down the kill chain\n- Assuming a log source is being collected without verifying it — a detection is worthless if its data source silently stopped ingesting\n- Never re-validating old rules — a detection that worked a year ago may not catch today's technique variant\n\n## Tools & techniques\n- MITRE ATT&CK matrix for coverage mapping and gap prioritization, tracked per platform (Windows\u002FLinux\u002FCloud\u002FContainers)\n- Sigma rule format for vendor-agnostic detection-as-code, compiled to Splunk SPL \u002F Sentinel KQL \u002F Elastic EQL\n- Atomic Red Team or purple-team exercises to validate that a detection actually fires on the targeted technique\n- Detection-as-code CI pipeline: syntax validation, required-field checks (ATT&CK tags, false-positive docs), automated compile-and-deploy\n- Efficacy metrics tracked over time: true\u002Ffalse positive rate, mean time to detect, alert-to-incident conversion rate\n","# Threat Detection — Best Practices\n\n## Focus\nBuilds and tunes the detection layer that catches attackers after they bypass preventive controls — SIEM rules, ATT&CK coverage mapping, and threat hunting that converts into automated detections.\n\n## Best practices\n- Map every detection rule to at least one MITRE ATT&CK technique — if you can't map it, you don't understand what it detects\n- Write rules in a vendor-agnostic format (Sigma) first, then compile to target SIEMs, so detection logic isn't locked to one platform\n- Prefer behavioral detections (process chains, anomalous sequences) over static IOC matching (IPs, hashes) — attackers rotate indicators daily\n- Document a false-positive profile for every rule before deployment — if you don't know what benign activity triggers it, it isn't tested\n- Prioritize coverage gaps by threat intelligence relevant to your actual environment\u002Findustry, not theoretical attacks from conference talks\n- Treat detection rules as code: version-controlled, peer-reviewed, tested against sample data, deployed via CI — never edited live in a console\n- Convert every successful threat hunt into an automated detection — manual discoveries that don't become rules will be missed next time\n\n## Common pitfalls\n- Deploying untested rules that either fire on everything or never fire at all\n- Chasing detection quantity over quality — a noisy SIEM trains analysts to ignore alerts, which is worse than no detection\n- Detecting only initial access and missing lateral movement, persistence, and exfiltration further down the kill chain\n- Assuming a log source is being collected without verifying it — a detection is worthless if its data source silently stopped ingesting\n- Never re-validating old rules — a detection that worked a year ago may not catch today's technique variant\n\n## Tools & techniques\n- MITRE ATT&CK matrix for coverage mapping and gap prioritization, tracked per platform (Windows\u002FLinux\u002FCloud\u002FContainers)\n- Sigma rule format for vendor-agnostic detection-as-code, compiled to Splunk SPL \u002F Sentinel KQL \u002F Elastic EQL\n- Atomic Red Team or purple-team exercises to validate that a detection actually fires on the targeted technique\n- Detection-as-code CI pipeline: syntax validation, required-field checks (ATT&CK tags, false-positive docs), automated compile-and-deploy\n- Efficacy metrics tracked over time: true\u002Ffalse positive rate, mean time to detect, alert-to-incident conversion rate\n",{"name":5,"tags":43,"tools":44,"source":48,"license":14,"description":7},[26,21,36],[45,46,47],"monograph_query","monograph_context","monograph_impact","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind","main","f7cd4595d0f8959822163e14f9787117765c931a","packages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fthreat-detection",2,"https:\u002F\u002Fmonoes.github.io\u002Fmonomind\u002F","https:\u002F\u002Fgithub.com\u002Fmonoes","https:\u002F\u002Fmonoes.me","2026-11-14 03:30:52",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add monoes\u002Fmonomind --skill threat-detection",{"tool":63,"command":64},"bunx","bunx skills add monoes\u002Fmonomind --skill threat-detection",{"tool":66,"command":67},"pnpm","pnpm dlx skills add monoes\u002Fmonomind --skill threat-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fthreat-detection\u002FSKILL.md",true,[],[72,93,128,155,180,207],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":38},"01M71PB3SHWKMNJM6MD65VX8D6","zk-steward","Org role guidance for a ZK steward: engineer zero-knowledge proof systems with circuit design, SNARK vs STARK choice and security review. This is zero-knowledge cryptography, not Zettelkasten note-taking.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fzk-steward\u002FSKILL.md",[],[79,80,81,82,35,83,84,85,34,31,86,87,29,88,89,90,91,26,25,92],"zk","zk steward","steward","zero-knowledge","choice","design","knowledge","snark","review","security review","stark","zettelkasten","cryptography","blockchain",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":97,"licenseFileUrl":98,"sourceHtmlUrl":99,"categories":100,"keywords":111,"publishedAt":38},"01M71PB18SDG28WBKPKJNB814K","writing-plans","Use when you have a spec or requirements for a multi-step coding task and must write an implementation plan before touching code. Produces bite-sized TDD tasks with exact file paths, code and commands for an engineer with zero context.","MIT","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwriting-plans\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwriting-plans\u002FSKILL.md",[101,106],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[112,113,114,35,115,116,32,117,31,118,119,120,121,122,123,124,125,126,22,127],"writing","writing plans","plans","superpowers","implementation plan","you","code","tasks","plan","product","write","commands","paths","suggest","coding","ZeRO",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":138,"publishedAt":38},"01M71PAXFM488X9ARXK0T04TF5","write-spec","Write a feature spec or PRD from a problem statement or feature idea. Use when turning a vague idea or user request into a structured document, scoping a feature with goals and non-goals, defining success metrics and acceptance criteria, or breaking a big ask into a phased spec.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-spec\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-spec\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000031","产品经理",[122,139,140,141,142,85,143,32,144,145,146,121,147,148,149,150,151,152,153,154],"write spec","spec","user request","problem","acceptance","ask","vague","work","request","scoping","idea","metrics","feature","problem statement","use","document",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":159,"sourceHtmlUrl":160,"categories":161,"keywords":165,"publishedAt":38},"01M71PASSZY800C0RPEARBS918","write-query","Write optimized SQL for your dialect with best practices. Use when translating a natural-language data need into SQL, building a multi-CTE query with joins and aggregations, optimizing a query against a large partitioned table, or getting dialect-specific syntax for Snowflake, BigQuery, Postgres, etc.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-query\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-query\u002FSKILL.md",[162],{"categoryNo":163,"categoryName":164,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000033","数据分析师",[31,122,166,167,168,169,85,153,32,170,171,172,173,146,174,175,176,177,178,179],"write query","postgres","for","snowflake","best practices","natural-language","with","multi","github","sql","https","syntax","plugins","data",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":192,"publishedAt":38},"01M71PAPTX0T3PF6ETFVR96SJJ","workflow-automation","Org role guidance for workflow automation: build and maintain CI\u002FCD definitions in GitHub Actions or equivalent: triggers, jobs, matrices, caching. Covers path filters, dependency caching, parallel jobs, timeouts and fail-fast ordering.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fworkflow-automation\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":190,"categoryName":191,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000023","Skill与智能体开发",[193,194,195,196,168,197,198,199,200,34,201,202,203,31,29,174,204,205,206,176],"Workflow Automation","automation","workflow","parallel","actions","ci","triggers","github actions","maintain","filters","caching","build","dependency","devops",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":38},"01M71PAM19Z1XTV9NPCFSE2MY8","workflow-architect","Org role guidance for a workflow architect: map full workflow trees for systems, user journeys and agents, covering every branch and failure. Covers discovering workflows from code, handoff contracts, timeouts, recovery paths and observable state.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fworkflow-architect\u002FSKILL.md",[213],{"categoryNo":190,"categoryName":191,"taxonomyType":104,"taxonomyTypeDesc":105},[195,215,216,217,218,219,220,168,221,222,118,223,224,225,29,174,226,227,176,228],"workflow architect","architect","trees","user journeys","branch","planning","map","workflows","architecture","state","leadership","recovery","operations","systems"]