{
 "schema": "aiblocks-page/1",
 "id": "telemetry-detection-rule-builder",
 "type": "skill",
 "name": "Security alert rule builder",
 "summary": "Build a detection rule from one threat behavior and redacted logs. You get test cases and a report that says which checks were actually run.",
 "headline": "Security alert rule builder",
 "subhead": "Give your AI one threat behavior and some redacted logs. It drafts one detection rule and a set of test events. It then reports which tests it really ran and which it did not.",
 "job": {
  "id": "secure-code",
  "name": "Keep your code secure"
 },
 "level": "intermediate",
 "thinking": "high",
 "tested": true,
 "updated": "2026-10-28",
 "first_published": "2026-10-26",
 "inputs": [
  {
   "type": "question",
   "required": true,
   "label": "Question",
   "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like"
  },
  {
   "type": "dataset",
   "required": true,
   "label": "Dataset",
   "what": "data files to process or analyse, such as a CSV or JSON export, logs, lab or sensor files, with their format and where they came from"
  }
 ],
 "outputs": [
  {
   "type": "code_change",
   "required": true,
   "label": "Code change",
   "what": "a change to the code, with what it fixes and how it was checked"
  },
  {
   "type": "test_report",
   "required": true,
   "label": "Test report",
   "what": "what was tested, what passed, what failed and why"
  }
 ],
 "you_give": [
  "The behavior you want to detect, in plain words.",
  "Your rule language and its version, such as Sigma or KQL.",
  "Redacted events that show the behavior.",
  "Redacted normal events that look similar.",
  "Your list of log fields and known log gaps (optional)."
 ],
 "you_get": [
  "A draft detection rule.",
  "A map from each rule condition to a log field.",
  "Test events that should match, should not match, or look similar, with expected results.",
  "Real test results, or a clear list of checks that were not run."
 ],
 "use_when": [
  "You have one behavior to catch and need a first rule draft.",
  "You want test events for a rule before your team reviews it.",
  "You need to see which log fields a rule depends on.",
  "You want a clear record of what was tested and what was not."
 ],
 "skip_when": [
  "You want to deploy a rule or switch off alerts: use your SIEM team's normal change and review process.",
  "You need to test against a live system or run an attack: use an approved test lab and your security team.",
  "You have no logs or field list yet: first ask your logging team which fields your log source records."
 ],
 "output_sample": {
  "input": [
   "The behavior you want to catch, in plain words",
   "Your rule language and its version, such as Sigma or KQL",
   "Redacted events that show the behavior, and normal events that look similar",
   "Your list of log fields and any known gaps in your logs (optional)"
  ],
  "prerequisites": [
   "Permission to monitor the systems the rule covers",
   "A compiler or replay tool for your rule language, if you want real test results (optional)"
  ],
  "output": [
   {
    "name": "Rule draft",
    "contains": "One detection rule written in your chosen rule language and version."
   },
   {
    "name": "Field map",
    "contains": "Each rule condition matched to a real log field, or marked as an open gap."
   },
   {
    "name": "Fixture manifest",
    "contains": "Test events with an ID, the expected match or non-match, the reason and the condition tested."
   },
   {
    "name": "Exception check",
    "contains": "Tests showing that a fake trusted tool name in a command cannot skip the rule."
   },
   {
    "name": "Evidence table",
    "contains": "Each test with expected result, observed result, PASS, FAIL or NOT_RUN, and revision."
   },
   {
    "name": "Gaps and false-positive notes",
    "contains": "Missing fields, open assumptions and the tradeoffs in any exceptions."
   }
  ]
 },
 "how_to_use": [
  "Open Claude, ChatGPT or Gemini and add the skill folder or paste SKILL.md.",
  "Paste the behavior, your rule language and version, and your redacted events.",
  "Answer any question about missing log fields. Do not guess them.",
  "Read the field map and the fixture list. Check each expected result.",
  "If your AI can run code and has your compiler, let it run the tests. Otherwise run the test plan yourself.",
  "Send the rule and evidence table to your SIEM team for peer review."
 ],
 "checks": [
  "Every rule condition maps to supplied telemetry or an explicit unresolved requirement.",
  "Required fixtures and fields block a validation pass when absent.",
  "A lookalike trusted-tool string cannot silently trigger an allowlist exemption.",
  "Compilation/replay statuses describe actual target-engine checks, not guessed success."
 ],
 "next": [
  {
   "name": "MCP server security reviewer",
   "url": "https://useaiblocks.com/skills/mcp-server-hardener",
   "why": "MCP server security reviewer"
  },
  {
   "name": "Code change security reviewer",
   "url": "https://useaiblocks.com/prompts/diff-security-skimmer",
   "why": "Code change security reviewer"
  },
  {
   "name": "Code security warning checker",
   "url": "https://useaiblocks.com/skills/insecure-code-catcher",
   "why": "Code security warning checker"
  },
  {
   "name": "Code change test coverage reviewer",
   "url": "https://useaiblocks.com/skills/test-gap-finder",
   "why": "Code change test coverage reviewer"
  },
  {
   "name": "Software test gap finder",
   "url": "https://useaiblocks.com/skills/copilot-test-gap-audit",
   "why": "Software test gap finder"
  }
 ],
 "source": {
  "by": "Michael Sitarzewski and Agency Agents contributors",
  "repo": "msitarzewski/agency-agents",
  "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-threat-detection-engineer.md",
  "licence": "MIT",
  "original_name": "Threat Detection Engineer",
  "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219"
 },
 "credits": [
  {
   "title": "Threat Detection Engineer",
   "by": "Michael Sitarzewski and Agency Agents contributors",
   "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-threat-detection-engineer.md",
   "used": "Selected task methods, rewritten and narrowed by AI Blocks. Original role profile retained only as provenance/background."
  }
 ],
 "files": [
  "LICENSE",
  "references/agency-security-threat-detection-engineer.md",
  "source.json"
 ],
 "links": {
  "page": "https://useaiblocks.com/skills/telemetry-detection-rule-builder",
  "markdown": "https://useaiblocks.com/skills/telemetry-detection-rule-builder.md",
  "json": "https://useaiblocks.com/skills/telemetry-detection-rule-builder.json",
  "instructions": "https://useaiblocks.com/skills/telemetry-detection-rule-builder/SKILL.md",
  "download": "https://useaiblocks.com/skills/telemetry-detection-rule-builder.zip",
  "api_item": "https://useaiblocks.com/api/v1/items/telemetry-detection-rule-builder",
  "api_document": "https://useaiblocks.com/api/v1/documents/skill/telemetry-detection-rule-builder",
  "mcp": "https://useaiblocks.com/mcp"
 }
}