Plugin Claude Code
Production-grade sigma detection rule writing, validation, and conversion for SOC analysts and threat-intel teams. LLM-assisted draft + pySigma validation + multi-backend conversion (Splunk, Elastic, OpenSearch, Wazuh) with logsource-aware processing pipelines. Ships a 278-rule published corpus spanning 14 MITRE…
MCP server Claude CodeCodexCursor +2
MCP server "wrg-sigma-rules" as configured in WRG-11/wrg-sigma-rules. Runs ${CLAUDE_PLUGIN_ROOT}/server.py with python. Needs 1 environment variable to run.
Skill Claude CodeCodex
Review an existing sigma rule for spec compliance, detection quality, and improvement opportunities. Use when the user pastes a sigma YAML rule, asks "is this rule any good", asks for a code review on a detection, or wants to harden a rule against false positives. Runs pySigma validation, best-practices linter, and…
Skill Claude CodeCodex
Guided sigma detection rule writing from a natural language threat description. Use when the user asks to write a sigma rule, SIEM detection rule, EDR alert logic, or any "detect when X happens" question. Asks clarifying questions (logsource, MITRE ATT&CK TTP, severity), drafts YAML via…
Skill Claude CodeCodex
Analyze a sigma rule corpus against the MITRE ATT&CK matrix and produce a coverage gap report. Use when the user asks "what TTPs am I missing", asks for a coverage report, wants to compare their detections against a threat actor profile (e.g. APT29, Scattered Spider), or wants a prioritized list of detection rules to…