sota-detection-engineeringlisted
State-of-the-art detection engineering, SOC, threat hunting, and incident response (2026). Use when BUILDING detective controls or SOC capability — Sigma/YARA/Falco/Tetragon/Suricata rules, detection-as-code, MITRE ATT&CK coverage, SIEM detections, alert triage and SOAR, threat hunts, threat-intel, deception, IR playbooks, or adversary emulation — AND when AUDITING detection & IR posture (can we detect this? does this alert fire?). Owns DETECTIVE controls, SOC workflow, hunting, and IR (sota-observability owns the telemetry pipeline). Trigger keywords: detection engineering, detection-as-code, Sigma, YARA, YARA-X, Falco, Tetragon, Suricata, SIEM, KQL, SPL, EQL, ATT&CK, Pyramid of Pain, threat hunting, threat intel, TIP, STIX, TAXII, IOC, IOA, TTP, SOC, alert fatigue, tuning, SOAR, runbook, incident response, IR playbook, NIST 800-61, PICERL, forensics, chain of custody, purple team, honeypot, honeytoken, canary, OCSF, MTTD, false positive, Active Directory, Kerberoasting, DCSync, golden ticket, ADCS, RBCD.
martinholovsky/SOTA-skills · ★ 8 · AI & Automation · score 75
Install: claude install-skill martinholovsky/SOTA-skills
# SOTA Detection Engineering, SOC & Incident Response
## Purpose
Assume prevention fails. This skill builds and audits the layer that *notices*:
detective controls, the SOC that triages them, the hunts that find what alerts
miss, and the IR process that contains what hunts surface. One question defines
success:
> **When a real adversary acts inside your environment, does a high-fidelity
> signal fire, reach a human (or automation) with the context to act, and drive
> a bounded response — fast enough to matter?**
Detection is engineering, not art. Detections are **code**: version-controlled,
peer-reviewed, CI-tested, ATT&CK-mapped, FP-budgeted, and retired when stale.
The dominant failure mode is not missing rules — it is **alert fatigue**: noise
that buries the one true positive. Optimize signal-to-noise relentlessly.
**Ownership boundary.** `sota-observability` owns the telemetry pipeline (logs,
metrics, traces, SLOs, log shipping, retention plumbing). This skill owns
turning that telemetry into *security* detections, the SOC workflow, hunting,
and IR. `sota-threat-modeling` owns design-time threat enumeration (STRIDE/
ATT&CK/ATLAS catalogs); this skill owns catching those threats at runtime. If
you find yourself designing the logging schema, that's observability rules/01;
if you find yourself enumerating threats on a DFD, that's threat-modeling.
## BUILD mode
Run the detection lifecycle as a loop, not a one-shot. Hypothesis → build →
test → deploy → tune → retire. Wo