building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Critical
Do not install without reviewing
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific security engineering niche. It provides concrete actions, comprehensive trigger terms that security professionals would naturally use, and an explicit 'Use when' clause with well-defined scenarios. The description is concise yet thorough, making it easy for Claude to distinguish this skill from others.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: building vendor-agnostic detection rules, mapping rules to MITRE ATT&CK techniques, converting community Sigma rules into platform-specific queries using sigmac or pySigma backends. | 3 / 3 |
Completeness | Clearly answers both 'what' (builds vendor-agnostic detection rules using Sigma format across SIEM platforms) and 'when' (explicit 'Use when' clause covering creating detection logic from threat intelligence, mapping to MITRE ATT&CK, or converting Sigma rules to platform-specific queries). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms a security professional would use: 'Sigma rule', 'SIEM', 'Splunk', 'Elastic', 'Microsoft Sentinel', 'MITRE ATT&CK', 'detection rules', 'threat intelligence', 'sigmac', 'pySigma', 'detection logic'. These are highly specific and naturally used keywords. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on Sigma rule format for threat detection. The combination of Sigma rules, SIEM platforms, MITRE ATT&CK mapping, and sigmac/pySigma backends creates a very clear and unique domain that is unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, highly actionable skill with excellent executable examples covering the full Sigma rule lifecycle from creation through CI/CD deployment. The workflow is well-sequenced with appropriate validation checkpoints. However, it's overly long for a SKILL.md file, with several sections (Key Concepts, Tools & Systems, Common Scenarios) that add descriptive bulk without actionable value, and would benefit from being split into referenced sub-files.
Suggestions
Move the Key Concepts table, Tools & Systems, and Common Scenarios sections into a separate REFERENCE.md file and link to it from the main skill
Remove or significantly trim explanatory content that Claude already knows (e.g., definitions of Sigma, backends, pipelines) to reduce token usage
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary sections like the Key Concepts table (Claude knows what Sigma, backends, and pipelines are) and the Common Scenarios section which is more descriptive than instructive. The Tools & Systems section also adds little actionable value. However, the core workflow steps are reasonably efficient. | 2 / 3 |
Actionability | The skill provides fully executable Python code for rule creation, validation, and conversion across three SIEM platforms. The Sigma YAML rule is complete and copy-paste ready, the pySigma validation and conversion scripts are concrete, and the CI/CD workflow YAML is directly usable. | 3 / 3 |
Workflow Clarity | The 7-step workflow is clearly sequenced from threat intelligence through deployment, with explicit validation at Step 2 (syntax check), Step 5 (testing against sample data with false positive validation), and CI/CD integration in Step 7. The validate-then-convert-then-test-then-deploy sequence includes appropriate checkpoints for a detection engineering workflow. | 3 / 3 |
Progressive Disclosure | The content is a monolithic document with no references to external files for advanced topics. The Key Concepts table, Tools & Systems section, Common Scenarios, and Output Format could be split into separate reference files. At ~200+ lines, this would benefit from a quick-start overview with links to detailed guides for each SIEM backend or advanced topics like ATT&CK Navigator coverage mapping. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.