siem-rule

What this skill does

Guides the full lifecycle of a SIEM detection rule: define the threat objective, identify required log sources, write a platform-agnostic Sigma rule, convert it to Splunk SPL, Elastic KQL/EQL, and Microsoft Sentinel KQL, validate against test data, and document tuning recommendations. Covers endpoint, network, identity, and cloud detection categories.

When to use

• Building new detections from a threat model, IOC, or observed TTP
• Converting an existing Sigma rule to a platform-specific query
• Auditing existing rules for performance, fidelity, or coverage gaps
• Responding to a new CVE or threat actor report and needing a fast rule
• Reducing alert fatigue by tuning false-positive-heavy detections

Prerequisites

• sigma-cli for rule conversion: pip install sigma-cli
• Sigma backends: sigma plugin install splunk elastic-lucene microsoft365defender
• python3 for validation and formatting helpers
• jq for JSON manipulation: sudo apt install jq
• Access to at least one SIEM platform (Splunk / Elastic / Sentinel) or sample log data

Inputs

Variable	Description	Example
DETECTION_OBJECTIVE	One-sentence description of what to detect	"Detect PowerShell downloading and executing in-memory payloads"
LOG_SOURCE_TYPE	Primary log source type	windows_process_creation
MITRE_TECHNIQUE	MITRE ATT&CK technique ID (optional)	T1059.001
SIGMA_RULE_FILE	Existing Sigma YAML file to convert (optional)	/tmp/rule.yml
TEST_LOG_FILE	Sample log file for validation (optional)	/tmp/test_events.json

Workflow

Step 1: Define the detection objective

echo "=== Step 1: Define Detection Objective ==="

DETECTION_OBJECTIVE="${DETECTION_OBJECTIVE:-}"
MITRE_TECHNIQUE="${MITRE_TECHNIQUE:-}"

if [ -z "$DETECTION_OBJECTIVE" ]; then
    read -rp "What threat behavior do you want to detect? " DETECTION_OBJECTIVE
fi

if [ -z "$MITRE_TECHNIQUE" ]; then
    read -rp "MITRE ATT&CK technique ID (leave blank to skip): " MITRE_TECHNIQUE
fi

echo ""
echo "  Objective:        $DETECTION_OBJECTIVE"
echo "  MITRE technique:  ${MITRE_TECHNIQUE:-N/A}"
echo ""

# Suggest detection category based on objective keywords
python3 - "$DETECTION_OBJECTIVE" <<'PYEOF'
import sys, re

obj = sys.argv[1].lower()

categories = {
    'Endpoint – Process Creation':    ['powershell', 'cmd', 'wscript', 'mshta', 'rundll32', 'regsvr32',
                                       'process', 'spawn', 'execute', 'launch', 'child'],
    'Endpoint – Registry':            ['registry', 'regedit', 'hklm', 'hkcu', 'run key', 'persistence'],
    'Endpoint – DLL / Code Injection':['inject', 'dll', 'reflective', 'shellcode', 'virtualalloc', 'writeprocessmemory'],
    'Endpoint – PowerShell / Script': ['powershell', 'script', 'iex', 'invoke-expression', 'base64', 'bypass'],
    'Network – DNS':                  ['dns', 'tunnel', 'dga', 'domain generation', 'exfil'],
    'Network – Lateral Movement':     ['smb', 'rdp', 'wmi', 'lateral', 'pass the hash', 'psexec'],
    'Identity – Brute Force':         ['brute', 'password spray', 'login failure', 'authentication'],
    'Identity – Kerberos':            ['kerberoast', 'dcsync', 'golden ticket', 'silver ticket', 'kerberos'],
    'Cloud – IAM':                    ['iam', 'policy', 'privilege', 'assume role', 'access key'],
    'Cloud – Storage':                ['s3', 'blob', 'bucket', 'public access', 'storage'],
}

matched = []
for cat, keywords in categories.items():
    if any(kw in obj for kw in keywords):
        matched.append(cat)

if matched:
    print(f"  Suggested category: {matched[0]}")
    if len(matched) > 1:
        print(f"  Also relevant:      {', '.join(matched[1:])}")
else:
    print("  Category: General endpoint/network (review log sources in Step 2)")
PYEOF