agentsclimarketplace
Sign in

Operationalizing a hunt into a detection

Skill meltedinhex/analyst-ai-pack/skills/operationalizing-a-hunt-into-a-detection

Converts a successful threat hunt into a durable detection by extracting the discriminating logic, defining data sources and thresholds, and emitting a Sigma rule plus a test and tuning plan. Activates for requests to operationalize a hunt, turn a finding into a detection rule, or productionize hunt logic as a Sigma detection.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill operationalizing-a-hunt-into-a-detection

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 437 tokens by cl100k_base, as published. Nobody here has run it

Operationalizing a Hunt Into a Detection

When to Use

  • A hunt surfaced malicious activity and you want to convert the discriminating logic into a repeatable detection (Sigma) with data sources, thresholds, and a tuning plan.
  • You are closing the hunt→detect loop so the finding is caught automatically next time.

Do not use this to ship a rule without a false-positive review — operationalization includes tuning. The script generates rule scaffolding, not a deployment.

Prerequisites

  • The hunt's discriminating fields/values, the data source/log channel, and the mapped ATT&CK technique.

Workflow

Step 1: Specify the detection

Define the logsource (category/product), the selection (field→value(s) that discriminated true positives), optional filters, the condition, and the ATT&CK technique.

Step 2: Generate the Sigma rule

python scripts/analyst.py generate --spec detection.json --out rule.yml

Emits a valid Sigma rule (title, status, logsource, detection, condition, level, tags) from the spec.

Step 3: Plan testing and tuning

Define how to validate (replay a known-true pcap/log, atomic test) and what benign sources may cause false positives.

Step 4: Document and stage

Record the rule's intent, expected FPs, and tuning levers; stage through your detection pipeline.

Validation

  • The generated rule has logsource, detection, and condition keys.
  • The selection encodes the fields/values that discriminated the hunt's true positives.
  • The rule is tagged with the relevant ATT&CK technique.

Pitfalls

  • Encoding incidental artifacts (one host's path) instead of generalizable logic.
  • Omitting filters for known-benign sources, guaranteeing alert fatigue.
  • No test plan, so regressions go unnoticed.

References

What ships with it: 3 files

4.3 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.