Agent Skills
› mtarcure/claude-vibe-squad
› detection-as-code
detection-as-code
GitHub用于以代码形式编写和测试SIEM/EDR检测规则（Sigma/YARA/KQL/SPL），涵盖TTP建模、正负样本验证及历史回溯，确保规则准确部署。
Trigger Scenarios
需要编写安全检测规则
对现有检测规则进行回溯测试
Install
npx skills add mtarcure/claude-vibe-squad --skill detection-as-code -g -y
SKILL.md
Frontmatter
{
"name": "detection-as-code",
"audience": "specialist",
"description": "Use when a detection engineer must author a Sigma, YARA, KQL, or SPL SIEM\/EDR rule for a named TTP—pin the telemetry schema, add must-fire and must-not-fire fixtures, and replay representative history before any gated rollout. Not for incident triage or source-code defect scanning."
}
Detection as Code
Author a SIEM/EDR detection rule as tested, versioned code (Sigma/YARA/KQL/SPL).
Steps
- State the target TTP, detection platform, and platform/schema version; confirm the telemetry prerequisites exist.
- Write the rule against real field names; keep attacker-TTP modelling strictly in service of detection.
- Add positive fixtures (must fire) and negative fixtures (must not over-fire); validate syntax.
- Backtest/replay against representative history; record expected FP/FN surface and rule cost/cardinality.
- Set rollout mode, owner, version, and rollback; deployment is operator-gated (
production_mutation).
Acceptance
- Positive fixture fires and negative fixture does not; syntax validated.
- Replay/backtest evidence present, or an explicit
unvalidatedstatus. - Owner, version, and rollback recorded; no live deploy without approval.
Version History
- d5262e2 Current 2026-09-11 11:47
