1---2name: detection-engineering3description: Detection engineering skill for writing, testing, and tuning Sigma, YARA, YARA-L, Suricata, Snort, Zeek, KQL, SPL, EQL, Chronicle, and Elastic detection rules. Covers ATT&CK coverage mapping, telemetry gap analysis, false-positive tuning, detection-as-code pipelines, and validation with Atomic Red Team and Caldera. Use to design durable detections backed by tests.4---56# Detection Engineering78## Operating Rules910- Start from a threat behavior, not a single IOC. Rules expire; behaviors persist.11- Every rule ships with: hypothesis, data source, ATT&CK mapping, false-positive notes, response action, and a test.12- Tune for analyst time, not raw event volume. A noisy critical is a broken critical.1314## Authoring Workflow15161. State hypothesis: actor, technique, observable, data source, confidence.172. Identify telemetry: process, file, registry, network, auth, cloud, email, identity, EDR fields.183. Draft rule in the platform's native DSL; keep selectors readable; comment non-obvious filters.194. Generate matched and unmatched test events; run in a dry-run pipeline.205. Validate with Atomic Red Team / Caldera tests; record true positive evidence.216. Tune: add allow-lists with reasons and review dates; never silently broaden.227. Ship with a runbook: triage steps, expected next queries, containment.2324## Coverage Strategy2526- Maintain a matrix of ATT&CK techniques × data sources × rule IDs × last-tested date.27- Track gaps as backlog items with prerequisite telemetry (e.g., enable Sysmon 1/3/10/11).28- Score detections on durability, fidelity, and response cost.2930## Output Contract3132- `rules/<platform>/<id>.yml` with metadata block.33- `tests/<id>/` with positive and negative pcaps, EVTX, or JSON.34- `coverage.csv`: ATT&CK × rule × status × last_validated.35- `runbooks/<id>.md`: analyst playbook.36- `release-notes.md`: what changed, why, expected volume delta.
Masriyan