SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
operationalizing-a-hunt-into-a-detection
0
Converts a successful threat hunt into a durable detection by extracting the discriminating logic, defining data sources and thresholds, and emitting a Sigma rule plus a test and tuning plan. Activates for requests to operationalize a hunt, turn a finding into a detection rule, or productionize hunt logic as a Sigma detection.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Operationalizing a Hunt Into a Detection ## When to Use - A hunt surfaced malicious activity and you want to convert the discriminating logic into a repeatable detection (Sigma) with data sources, thresholds, and a tuning plan. - You are closing the hunt→detect loop so the finding is caught automatically next time. **Do not use** this to ship a rule without a false-positive review — operationalization includes tuning. The script generates rule scaffolding, not a deployment. ## Prerequisites - The hunt's discriminating fields/values, the data source/log channel, and the mapped ATT&CK technique. ## Workflow ### Step 1: Specify the detection Define the logsource (category/product), the selection (field→value(s) that discriminated true positives), optional filters, the condition, and the ATT&CK technique. ### Step 2: Generate the Sigma rule ```bash python scripts/analyst.py generate --spec detection.json --out rule.yml ``` Emits a valid Sigma rule (title, status, logsource, detection, condition, level, tags) from the spec. ### Step 3: Plan testing and tuning Define how to validate (replay a known-true pcap/log, atomic test) and what benign sources may cause false positives. ### Step 4: Document and stage Record the rule's intent, expected FPs, and tuning levers; stage through your detection pipeline. ## Validation - The generated rule has logsource, detection, and condition keys. - The selection encodes the fields/values that discriminated the hunt's true positives. - The rule is tagged with the relevant ATT&CK technique. ## Pitfalls - Encoding incidental artifacts (one host's path) instead of generalizable logic. - Omitting filters for known-benign sources, guaranteeing alert fatigue. - No test plan, so regressions go unnoticed. ## References - See [`references/api-reference.md`](references/api-reference.md) for the rule generator. - Sigma specification and ATT&CK hunting resources (linked in frontmatter).