detection-as-code
Use when a detection engineer must author a Sigma, YARA, KQL, or SPL SIEM/EDR rule for a named TTP—pin the telemetry schema, add must-fire and must-not-fire fixtures, and replay representative history before any gated rollout. Not for incident triage or source-code defect scanning.
- License 许可
- MIT
- 最近更新
- 2026-10-08
- Stars
- ★ 11
- Forks
- 3
01 前言 Front Matter
- name
- detection-as-code
- audience
- specialist
- description
- Use when a detection engineer must author a Sigma, YARA, KQL, or SPL SIEM/EDR rule for a named TTP—pin the telemetry schema, add must-fire and must-not-fire fixtures, and replay representative history before any gated rollout. Not for incident triage or source-code defect scanning.
03 SKILL.md 正文
Detection as Code
Author a SIEM/EDR detection rule as tested, versioned code (Sigma/YARA/KQL/SPL).
Steps
- State the target TTP, detection platform, and platform/schema version; confirm the telemetry prerequisites exist.
- Write the rule against real field names; keep attacker-TTP modelling strictly in service of detection.
- Add positive fixtures (must fire) and negative fixtures (must not over-fire); validate syntax.
- Backtest/replay against representative history; record expected FP/FN surface and rule cost/cardinality.
- Set rollout mode, owner, version, and rollback; deployment is operator-gated (
production_mutation).
Acceptance
- Positive fixture fires and negative fixture does not; syntax validated.
- Replay/backtest evidence present, or an explicit
unvalidatedstatus. - Owner, version, and rollback recorded; no live deploy without approval.
04 同仓库更多 Skills
ci-cd-and-automation
Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.
chrome-devtools
Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).
chrome-cdp
Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a debuggable Chrome is running (launching it if needed) so the agent can navigate, read page content, inspect the DOM, run JavaScript, and take screenshots — without the user typing any launch command. Includes a first-class "review a live running app" flow: point Chrome at the app under development and inspect/screenshot the REAL page (what a static-artifact tool cannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when asked to "use chrome", "open chrome", "drive my browser", "read the page in chrome", "review the running app", "screenshot the app", or "/chrome-cdp".
check-identity-pack
Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.
changelog
Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.
cellxgene-census
Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs/downloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.