opensearch-detection-engineer

Featured

OpenSearch SIEM detection: SIGMA, query DSL, MITRE ATT&CK mapping, anomaly/correlation rules, alert validation, SOC escalation.

AI & Automation 412 stars 42 forks Updated 2 days ago MIT

Install

View on GitHub

Quality Score: 96/100

Stars 20%
87
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# OpenSearch Detection Engineering Methodology for authoring and validating SIEM detections on OpenSearch Security Analytics: SIGMA rules, query DSL translation, MITRE ATT&CK mapping, anomaly detection, correlation, and SOC incident escalation. Vendor-neutral framework with OpenSearch-specific API patterns. ## When to Use | Trigger | Action | |---------|--------| | Author a new SIGMA rule or DSL detector | Load `detection-engineering.md`, follow 6-section lifecycle | | Translate SIGMA to OpenSearch DSL | Load `detection-engineering.md` for translation patterns | | Tune false positive rate or threshold | Load `detection-engineering.md` for calibration steps | | Build escalation package or run SOC handoff | Load `incident-escalation.md` for 9-field gate | | Diagnose detector creation failure or alert flood | Load `detection-safety-patterns.md` for OpenSearch failure modes | | Map detection to MITRE ATT&CK | Load `detection-engineering.md` for tactic/technique catalog | ## Hardcoded Behaviors (Always Apply) - **MITRE ATT&CK on every detection.** Include technique ID (e.g., `T1110.003`), tactic name (e.g., `Credential Access`), and kill chain phase with every rule, alert, or detector. Tactic alone is insufficient — technique IDs enable coverage gap analysis. - **Field-existence check before rule creation.** Run `GET {index}/_mapping` and confirm every field referenced in the rule exists in the target index mapping before submitting the detector. Absent fields cause silent fa...

Details

Author
notque
Repository
notque/vexjoy-agent
Created
4 months ago
Last Updated
2 days ago
Language
Python
License
MIT

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

sota-detection-engineering

State-of-the-art detection engineering, SOC, threat hunting, and incident response (2026). Use when BUILDING detective controls or SOC capability — Sigma/YARA/Falco/Tetragon/Suricata rules, detection-as-code, MITRE ATT&CK coverage, SIEM detections, alert triage and SOAR, threat hunts, threat-intel, deception, IR playbooks, or adversary emulation — AND when AUDITING detection & IR posture (can we detect this? does this alert fire?). Owns DETECTIVE controls, SOC workflow, hunting, and IR (sota-observability owns the telemetry pipeline). Trigger keywords: detection engineering, detection-as-code, Sigma, YARA, YARA-X, Falco, Tetragon, Suricata, SIEM, KQL, SPL, EQL, ATT&CK, Pyramid of Pain, threat hunting, threat intel, TIP, STIX, TAXII, IOC, IOA, TTP, SOC, alert fatigue, tuning, SOAR, runbook, incident response, IR playbook, NIST 800-61, PICERL, forensics, chain of custody, purple team, honeypot, honeytoken, canary, OCSF, MTTD, false positive, Active Directory, Kerberoasting, DCSync, golden ticket, ADCS, RBCD.

8 Updated 2 days ago
martinholovsky
AI & Automation Listed

linmas-detection-rules-engineer

Detection rules engineering skill for SIEM logic, alert design, telemetry mapping, tuning, and false-positive reduction.

2 Updated 5 days ago
TanKimGwan
AI & Automation Listed

detection-rule

Use when authoring a SIEM detection rule or use case — mapping to MITRE ATT&CK techniques, writing Sigma rules, and tuning false positives for Splunk/Elastic/Sentinel. Triggers on "detection rule", "SIEM use case", "Sigma rule", "ATT&CK detection", "alert tuning", "detection engineering".

0 Updated today
noctua84