Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rules-with-sigmanpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rules-with-sigma -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rules-with-sigma -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/building-detection-rules-with-sigmagh skill install mukul975/Anthropic-Cybersecurity-Skills building-detection-rules-with-sigmagit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/building-detection-rules-with-sigma ~/.claude/skills/building-detection-rules-with-sigma # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/building-detection-rules-with-sigma ~/.agents/skills/building-detection-rules-with-sigma # Codex, Cursor, Gemini CLI, Copilot, OpenCode