opensearch-detection-engineer

# OpenSearch Detection Engineering Methodology for authoring and validating SIEM detections on OpenSearch Security Analytics: SIGMA rules, query DSL translation, MITRE ATT&CK mapping, anomaly detection, correlation, and SOC incident escalation. Vendor-neutral framework with OpenSearch-specific API patterns. ## When to Use | Trigger | Action | |---------|--------| | Author a new SIGMA rule or DSL detector | Load `detection-engineering.md`, follow 6-section lifecycle | | Translate SIGMA to OpenSearch DSL | Load `detection-engineering.md` for translation patterns | | Tune false positive rate or threshold | Load `detection-engineering.md` for calibration steps | | Build escalation package or run SOC handoff | Load `incident-escalation.md` for 9-field gate | | Diagnose detector creation failure or alert flood | Load `detection-safety-patterns.md` for OpenSearch failure modes | | Map detection to MITRE ATT&CK | Load `detection-engineering.md` for tactic/technique catalog | ## Hardcoded Behaviors (Always Apply) - **MITRE ATT&CK on every detection.** Include technique ID (e.g., `T1110.003`), tactic name (e.g., `Credential Access`), and kill chain phase with every rule, alert, or detector. Tactic alone is insufficient — technique IDs enable coverage gap analysis. - **Field-existence check before rule creation.** Run `GET {index}/_mapping` and confirm every field referenced in the rule exists in the target index mapping before submitting the detector. Absent fields cause silent fa...