{ "schema": "aiblocks-page/1", "id": "agency-security-threat-detection-engineer", "type": "agent", "name": "Threat detection rule planner", "summary": "Name the technique and your log sources. Get a Sigma detection rule, its false-positive cases, and where it sits in your MITRE ATT&CK coverage.", "headline": "Threat detection rule planner", "subhead": "Name the attacker technique you want to catch and the logs you actually collect. It writes a vendor-neutral Sigma rule, lists the cases that would falsely trigger it, and says where this sits in your MITRE ATT&CK coverage.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "source_text", "required": false, "label": "Source text", "what": "a long source in full: an article, a video or talk transcript, or notes from a book, with its title, author and link" } ], "outputs": [ { "type": "document", "required": true, "label": "Document", "what": "a finished document, such as a Word file, a PDF or a page of notes" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "The technique you want to detect, named plainly or by its MITRE ATT&CK ID, and why (a threat report, a past incident, a known gap).", "The log sources you actually collect (process logs, PowerShell logging, cloud audit logs, and so on) and how long you keep them.", "Your SIEM or detection platform, if you want the rule compiled to a specific query language (optional, Sigma works everywhere).", "Any known-benign activity that looks similar to the technique, so false positives can be named up front (optional)." ], "you_get": [ "A Sigma detection rule for the named technique, built against the log sources you actually have.", "A false-positive list: the normal activity most likely to trigger it, named before deployment, not after.", "A MITRE ATT&CK coverage note: where this technique sits, and what's still a gap nearby.", "A validation plan: how to confirm the rule fires on the real technique and stays quiet on normal activity." ], "use_when": [ "You know the attacker technique you want to detect (from a MITRE ATT&CK ID, a threat report, or your own incident) and want a rule for it.", "You want to know which MITRE ATT&CK techniques your current detections actually cover, and which are gaps.", "A detection rule is too noisy and you want its false-positive cases named so it can be tuned, not just muted.", "You're setting up detection-as-code and want rules written in Sigma so they aren't locked to one SIEM." ], "skip_when": [ "You have an active incident right now, not a detection gap to close. Use the Security incident responder.", "You want to test whether an attack actually gets through your defenses. Use the Penetration test planner.", "You want a one-time snapshot of your overall security posture, not an ongoing detection rule. Use the Security posture auditor." ], "output_sample": { "input": [ "The technique to detect, named or by MITRE ATT&CK ID", "The log sources you actually collect", "Your SIEM, if you want a compiled query (optional)", "Known-benign activity that looks similar (optional)" ], "prerequisites": [ "Log collection already in place for the sources the rule needs" ], "output": [ { "name": "Detection rule", "contains": "A Sigma rule for the named technique, built against the log sources you have." }, { "name": "False positive cases", "contains": "Normal activity most likely to trigger the rule, and how to exclude it." }, { "name": "MITRE ATT&CK mapping", "contains": "Where the technique sits on the framework, and nearby coverage gaps." }, { "name": "Validation plan", "contains": "How to confirm the rule fires on the real technique and stays quiet on normal activity." }, { "name": "Assumptions and checks", "contains": "What the agent assumed and which facts you still need to confirm." } ] }, "output_shape": "DETECTION RULE (Sigma)\n title: \n logsource: \n detection: \n level: \n\nFALSE POSITIVE CASES\n | | \n\nMITRE ATT&CK MAPPING\n Technique: | Tactic: | Nearby gaps: \n\nVALIDATION PLAN\n | \n\nASSUMPTIONS AND CHECKS STILL NEEDED\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.", "Name the technique you want to detect and the log sources you actually collect.", "Say which SIEM you use if you want the rule compiled to its query language; otherwise you'll get Sigma.", "Say \"Write the detection rule, its false-positive cases, and where this sits in my ATT&CK coverage.\"", "Check the log sources it assumes against what you actually collect. A rule needing a log you don't have won't fire.", "Run the validation plan against real or simulated activity before you trust the rule in production." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Threat intelligence analyst agent", "url": "https://useaiblocks.com/skills/agency-security-threat-intelligence-analyst", "why": "Threat intelligence analyst agent" }, { "name": "Microsoft threat model file builder", "url": "https://useaiblocks.com/skills/copilot-tm7-threat-model", "why": "Microsoft threat model file builder" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-threat-detection-engineer.md", "licence": "MIT", "original_name": "Threat Detection Engineer", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Threat Detection Engineer", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-threat-detection-engineer.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-threat-detection-engineer", "markdown": "https://useaiblocks.com/agents/agency-security-threat-detection-engineer.md", "json": "https://useaiblocks.com/agents/agency-security-threat-detection-engineer.json", "instructions": "https://useaiblocks.com/skills/agency-security-threat-detection-engineer/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-threat-detection-engineer.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-threat-detection-engineer", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-threat-detection-engineer", "mcp": "https://useaiblocks.com/mcp" } }