Assume prevention fails. This skill builds and audits the layer that notices:\ndetective controls, the SOC that triages them, the hunts that find what alerts\nmiss, and the IR process that contains what hunts surface. One question defines\nsuccess:
\n\n\nWhen a real adversary acts inside your environment, does a high-fidelity\nsignal fire, reach a human (or automation) with the context to act, and drive\na bounded response — fast enough to matter?
\n
Detection is engineering, not art. Detections are code: version-controlled,\npeer-reviewed, CI-tested, ATT&CK-mapped, FP-budgeted, and retired when stale.\nThe dominant failure mode is not missing rules — it is alert fatigue: noise\nthat buries the one true positive. Optimize signal-to-noise relentlessly.
\nOwnership boundary. sota-observability owns the telemetry pipeline (logs,\nmetrics, traces, SLOs, log shipping, retention plumbing). This skill owns\nturning that telemetry into security detections, the SOC workflow, hunting,\nand IR. sota-threat-modeling owns design-time threat enumeration (STRIDE/\nATT&CK/ATLAS catalogs); this skill owns catching those threats at runtime. If\nyou find yourself designing the logging schema, that's observability rules/01;\nif you find yourself enumerating threats on a DFD, that's threat-modeling.
Run the detection lifecycle as a loop, not a one-shot. Hypothesis → build →\ntest → deploy → tune → retire. Workflow:
\nFor hunting and deception, see rules/05; for IR, see rules/06.
\nAssess an existing detection/SOC/IR posture adversarially. Read rules/06 (IR &\nvalidation) and rules/04 (SOC/triage) first. Sample real detections, real\nalerts, and real incidents — do not trust a coverage dashboard or a wiki\nrunbook that has never fired. The cardinal test: pick three ATT&CK techniques\nrelevant to the environment and prove, end to end, that each would be caught.
\nSeverity:
\n| Severity | \nMeaning | \nExamples | \n
|---|---|---|
| Critical | \nBlind to a primary attack path, or IR cannot execute | \nNo log source for the crown-jewel system; no EDR/cloud-audit/K8s-audit collection; no IR plan or no one on call; detections exist but nothing routes alerts to a human | \n
| High | \nMajor coverage gap or SOC dysfunction | \nAlert fatigue (analysts mute/ignore); detections never tested against the technique; IOC-only coverage of behaviors that need TTP logic; runbooks absent or stale; no ATT&CK coverage map; retention too short for IR | \n
| Medium | \nDegraded fidelity or process gaps | \nDetections with no owner/ADS doc; suppressions with no expiry; no deduplication/correlation; severity inflation; no purple-team/regression testing; TI not operationalized into detections | \n
| Low | \nHygiene | \nDetections not in version control; inconsistent naming; no FP metrics; Navigator layer stale; no blameless PIR template | \n
| Info | \nObservation / hardening opportunity | \nDeception not deployed where it'd be high-value; coverage maturity below target; SOAR automation candidates | \n
Finding format (one per finding):
\nfile:line | rule | severity | effort (trivial/small/medium/large) | fix\nExample:
\ndetections/aws/iam.yml:14 | ioc-only-detection-of-ttp-behavior | High | medium |\n GuardDuty-finding-name match is brittle; rewrite as CloudTrail behavioral\n Sigma rule on CreateAccessKey+AttachUserPolicy by non-admin principal,\n test with Stratus Red Team aws.persistence.iam-create-admin-access-key.\nConclude with the verdict: for the top 3 techniques in scope, is detection\nPRESENT / PARTIAL / ABSENT end-to-end (signal → alert → human → response),\nand the shortest path to closing the worst gap.
\n| File | \nRead this when... | \n
|---|---|
rules/01-detection-engineering-discipline.md | \nRunning the detection lifecycle, writing ADS docs, doing detection-as-code (CI/peer review/regression), mapping coverage to ATT&CK + Navigator, applying the Pyramid of Pain, picking maturity targets and metrics (coverage/precision/MTTD) | \n
rules/02-telemetry-siem-data-layer.md | \nDeciding what to collect (the #1 gap), choosing SIEM/data-lake, normalizing with OCSF/ECS, sizing retention for IR/hunting, controlling volume/cost, assessing data quality | \n
rules/03-rule-languages-engines.md | \nChoosing and writing detections in Sigma, YARA/YARA-X, Suricata, Falco, Tetragon, or SIEM-native (KQL/SPL/EQL); rule quality, specificity, FP-resistance, performance; good/bad examples | \n
rules/04-alerting-triage-soc-soar.md | \nFighting alert fatigue, tuning/suppression with expiry, severity assignment, enrichment, dedup/correlation, runbooks, SOAR + auto-containment guardrails, case management, FP lifecycle, SOC metrics | \n
rules/05-hunting-intel-deception.md | \nHypothesis-driven hunting + the hunt loop, IOC vs IOA/TTP hunting, threat-intel lifecycle + TIP, STIX 2.1/TAXII 2.1, diamond model/kill chain, deception (honeypots/honeytokens/canaries) | \n
rules/06-incident-response-validation.md | \nRunning IR (NIST SP 800-61r3 / CSF 2.0, PICERL), playbooks, severity classification, containment/eradication/recovery, forensic readiness + chain of custody, blameless PIR, tabletops; validating detections via Atomic Red Team/Caldera/Stratus, purple teaming, regression testing | \n
rules/07-ad-attack-detection.md | \nDetecting on-prem Active Directory attacks: DC audit-policy telemetry and the events that matter (4768/4769/4770, 4662, 4624/4625, 5136, 8004, 4886/4887), Kerberoasting (RC4 TGS spikes), AS-REP roasting, DCSync (replication GUIDs on 4662), golden/silver tickets, DCShadow, ADCS abuse (ESC1), NTLM relay, password spraying, RBCD writes (5136); ATT&CK mapping (T1558.x, T1003.006, T1207, T1649) + AD deception (honeytoken SPNs, canary objects). Hardening lives in sota-identity-access rules/07 | \n