MHaggis

MHaggis/Security-Detections-MCP

Agent Cursor

False positive analyst. Use to assess FP risk before staging detections.

MHaggis/Security-Detections-MCP

Agent Cursor

Main workflow coordinator for the threat-to-detection pipeline.

MHaggis/Security-Detections-MCP

Agent Cursor

Reviews open PRs, validates content quality, identifies gaps, and adds improvements. Use to enhance existing PRs before merge.

MHaggis/Security-Detections-MCP

Agent Cursor

GitHub PR specialist. Use to stage DRAFT PRs to detection and attackdata repos. NEVER auto-merge.

MHaggis/Security-Detections-MCP

Agent Cursor

Quality assurance specialist. Use to review detection quality before PR staging.

MHaggis/Security-Detections-MCP

Agent Cursor

Detection validation specialist. Use after atomic execution to verify detections fire correctly in any SIEM.

MHaggis/Security-Detections-MCP

Agent Cursor

Splunk-specific detection validator. Use after atomic execution to verify SPL detections fire correctly in Splunk. For other SIEMs, use /siem-validator instead.

MHaggis/Security-Detections-MCP

Agent Cursor

Skeptical validator. Use after detection workflow claims completion to verify work actually done.

MHaggis/Security-Detections-MCP

Cursor rule Cursor

Cursor rule "contentctl-path" from MHaggis/Security-Detections-MCP, covering contentctl tool configuration (splunk-specific), location, pip install requirements, option 1: force reinstall and option 2: direct pypi url.

MHaggis/Security-Detections-MCP

Cursor rule Cursor

The tests: section MUST have valid URLs, NOT placeholder descriptions.

MHaggis/Security-Detections-MCP

Cursor rule Cursor

Linux detection testing workflow and lessons learned.

MHaggis/Security-Detections-MCP

Cursor rule Cursor

Any pip install command MUST include one of these options.

MHaggis/Security-Detections-MCP

Cursor rule Cursor

Self-healing behavior - automatically fix errors and continue.

MHaggis/Security-Detections-MCP

Cursor rule Cursor

Detection validation tools - location, usage, and multi-SIEM support.