Skip to content
Get packs

Building Sigma Detection Rules

Writes and converts vendor-neutral Sigma detection rules into Splunk, Elastic and Sentinel queries.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent helps security teams write detection rules in Sigma, a shared open format that describes what suspicious activity looks like in logs without tying it to one vendor. It can validate a rule, convert it into queries for platforms such as Splunk, Elastic and Microsoft Sentinel, tag it with MITRE ATT&CK technique IDs, and load a folder of rules to build a coverage map. The skill includes a Python helper script that uses the pySigma library to parse and convert rules.

Great for

  • SOC engineers who want one detection rule that works across several SIEM products
  • Teams adopting detection-as-code with rules stored in version control and CI/CD
  • Analysts turning threat intelligence or ATT&CK techniques into searchable detections

Skip it if

  • Real-time streaming detection, since the skill itself says Sigma is for batch or scheduled searches
  • Detections that rely on vendor-native features such as Splunk RBA risk scoring, which Sigma cannot express
  • Users without access to a SIEM and log sources, because converted queries cannot be tested meaningfully without them

Try asking

  • “Write a Sigma rule for LSASS credential dumping mapped to T1003.001 and convert it to Splunk SPL”
  • “Validate this Sigma YAML file and tell me any syntax or best-practice issues”
  • “Convert our folder of Sigma rules into Elastic Lucene queries and build an ATT&CK Navigator coverage layer”
  • “Turn this threat report's TTPs into draft Sigma detections with false positive notes”
Step-by-step guide: how to use Building Sigma Detection RulesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    building-detection-rules-with-sigma.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-detection-rules-with-sigma.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-detection-rules-with-sigma.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always test converted queries against sample Sysmon or log data and run new rules in a non-alerting saved search for about a week to measure false positives before enabling alerts.
  • Review generated SPL, Lucene or KQL before deploying, since field mappings depend on your log source schema and the pipeline used.
  • Give the agent the exact SIEM and log source (for example Sysmon process_access) so it chooses the correct pipeline and field names.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.