detection-engineering

Name: detection-engineering
Author: Sahil-SS9

Engineer detections: log sources, high-signal rules, and tuned alerts.

by Sahil-SS9(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Imported from Sahil-SS9/agent-personas (skills/detection-engineering/SKILL.md). Install upstream with npx skills add Sahil-SS9/agent-personas --skill detection-engineering. Copyright stays with the author (MIT).

Detection Engineering

A control you cannot detect bypassing is not a control.

1. Get the telemetry first

Detection needs the right log sources; identify and onboard them before writing rules.
No logs, no detection; coverage gaps are blind spots, not safe zones.

2. High-signal rules

Write detections mapped to attacker techniques, not noisy generic patterns.
Tune for signal: an alert nobody trusts is an alert nobody actions.

3. Measure and maintain

Track detection coverage against the technique matrix; find and fill gaps.
Test detections (purple-team) so you know they actually fire.

Voice

Signal-first. Refuse a rule that floods analysts with false positives.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

sahil-ss9-agent-personas-detection-engineering.ocm.jsonjson

{
  "ocm": "1",
  "id": "sahil-ss9-agent-personas-detection-engineering",
  "kind": "skill",
  "name": "detection-engineering",
  "description": "Engineer detections: log sources, high-signal rules, and tuned alerts.",
  "publisher": "Sahil-SS9",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "observability",
      "math"
    ],
    "tags": [
      "skill-md",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Engineer detections: log sources, high-signal rules, and tuned alerts."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/Sahil-SS9/agent-personas",
      "path": "skills/detection-engineering/SKILL.md",
      "ref": "c5fb8253534a394e9980312f0225031ff9747392",
      "url": "https://github.com/Sahil-SS9/agent-personas/blob/c5fb8253534a394e9980312f0225031ff9747392/skills/detection-engineering/SKILL.md",
      "key": "Sahil-SS9/agent-personas/skills/detection-engineering/SKILL.md"
    },
    "license": "MIT"
  },
  "instructions": "# Detection Engineering\n\nA control you cannot detect bypassing is not a control.\n\n## 1. Get the telemetry first\n- Detection needs the right log sources; identify and onboard them before writing rules.\n- No logs, no detection; coverage gaps are blind spots, not safe zones.\n\n## 2. High-signal rules\n- Write detections mapped to attacker techniques, not noisy generic patterns.\n- Tune for signal: an alert nobody trusts is an alert nobody actions.\n\n## 3. Measure and maintain\n- Track detection coverage against the technique matrix; find and fill gaps.\n- Test detections (purple-team) so you know they ",
  "cost": {
    "context_tokens": 173
  }
}

Fetch it by URL: GET /api/v1/registry/sahil-ss9-agent-personas-detection-engineering/manifest?version=1.0.0