building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Critical
Do not install without reviewing
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific security engineering niche. It provides concrete actions, comprehensive trigger terms that security professionals would naturally use, and an explicit 'Use when' clause with well-defined scenarios. The description is concise yet thorough, making it easy to distinguish from other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: building vendor-agnostic detection rules, mapping rules to MITRE ATT&CK techniques, converting community Sigma rules into platform-specific queries using sigmac or pySigma backends. | 3 / 3 |
Completeness | Clearly answers both 'what' (builds vendor-agnostic detection rules using Sigma format across SIEM platforms) and 'when' (explicit 'Use when' clause covering creating detection logic from threat intelligence, mapping to MITRE ATT&CK, or converting Sigma rules to platform-specific queries). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms a security professional would use: 'Sigma rule', 'SIEM', 'Splunk', 'Elastic', 'Microsoft Sentinel', 'MITRE ATT&CK', 'detection rules', 'threat intelligence', 'sigmac', 'pySigma', 'detection logic'. These are highly specific and naturally used keywords. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on Sigma rule format for threat detection. The combination of Sigma rules, SIEM platforms, MITRE ATT&CK mapping, and sigmac/pySigma backends creates a very clear and unique domain that is unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, highly actionable skill with excellent workflow clarity and concrete, executable examples covering the full Sigma rule lifecycle. Its main weaknesses are moderate verbosity — particularly in supplementary sections (Key Concepts, Tools & Systems, Common Scenarios) that explain things Claude already knows — and a monolithic structure that would benefit from splitting reference material into separate files.
Suggestions
Move the Key Concepts table, Tools & Systems, and Common Scenarios sections into a separate REFERENCE.md file, keeping only a brief link in the main skill
Remove explanatory descriptions from the Key Concepts table entries — Claude already understands what backends, pipelines, and logsources are; instead just note project-specific conventions or gotchas
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary sections like the 'Key Concepts' table defining terms Claude already knows (e.g., what a backend or pipeline is), the 'Common Scenarios' section that adds little actionable value, and the 'Tools & Systems' descriptions. The core workflow steps are reasonably efficient but the overall document could be tightened significantly. | 2 / 3 |
Actionability | The skill provides fully executable Python code for rule creation, validation, and conversion across three SIEM platforms. The Sigma YAML rule is complete and copy-paste ready, the pySigma conversion examples are concrete with expected output shown, and the CI/CD GitHub Actions workflow is directly usable. | 3 / 3 |
Workflow Clarity | The 7-step workflow is clearly sequenced from threat intelligence through deployment, with explicit validation at Step 2 (syntax checking with both CLI and Python approaches), testing at Step 5 (including false positive validation against production data), and CI/CD integration at Step 7 providing automated validation feedback loops. | 3 / 3 |
Progressive Disclosure | The content is entirely monolithic — a long single document with no references to external files for advanced topics. The Key Concepts table, Tools & Systems section, Common Scenarios, and Output Format could be split into separate reference files. For a skill of this length (~200+ lines), better content splitting would improve navigability. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
888bbe4
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.