Agent Skills
› mtarcure/claude-vibe-squad
› detection-as-code
detection-as-code
GitHub用于将SIEM/EDR检测规则（Sigma/YARA等）作为代码编写，通过添加正负样本、回溯测试和版本控制确保规则有效性，适用于安全检测工程场景。
触发场景
需要编写或更新SIEM/EDR检测规则
对现有检测规则进行验证和回溯测试
安装
npx skills add mtarcure/claude-vibe-squad --skill detection-as-code -g -y
SKILL.md
Frontmatter
{
"name": "detection-as-code",
"audience": "specialist",
"description": "Use when a detection engineer must author a Sigma, YARA, KQL, or SPL SIEM\/EDR rule for a named TTP—pin the telemetry schema, add must-fire and must-not-fire fixtures, and replay representative history before any gated rollout. Not for incident triage or source-code defect scanning."
}
Detection as Code
Author a SIEM/EDR detection rule as tested, versioned code (Sigma/YARA/KQL/SPL).
Steps
- State the target TTP, detection platform, and platform/schema version; confirm the telemetry prerequisites exist.
- Write the rule against real field names; keep attacker-TTP modelling strictly in service of detection.
- Add positive fixtures (must fire) and negative fixtures (must not over-fire); validate syntax.
- Backtest/replay against representative history; record expected FP/FN surface and rule cost/cardinality.
- Set rollout mode, owner, version, and rollback; deployment is operator-gated (
production_mutation).
Acceptance
- Positive fixture fires and negative fixture does not; syntax validated.
- Replay/backtest evidence present, or an explicit
unvalidatedstatus. - Owner, version, and rollback recorded; no live deploy without approval.
版本历史
- d5262e2 当前 2026-09-11 11:16
