Guardrail violated: Sigma `status: stable` is lifecycle, while `level: critical` is impact/priority. Neither proves telemetry coverage or backend execution. Stop and mark the detection `blocked` or `not-tested`. Restart classification only after verifying: - Analytic question, behavior hypothesis, scope, owner, and limitations. - Required telemetry source, fields, collection path, retention, and clock quality. - Executable predicates, entity keys, time window, cardinality, ordered correlation...
Installs into .claude/skills of the current project.
Are you the author of Cyber Detection Engineering?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-detection-engineering-300181cf)
Guardrail violated: Sigma `status: stable` is lifecycle, while `level: critical` is impact/priority. Neither proves telemetry coverage or backend execution.
Stop and mark the detection `blocked` or `not-tested`. Restart classification only after verifying:
- Analytic question, behavior hypothesis, scope, owner, and limitations.
- Required telemetry source, fields, collection path, retention, and clock quality.
- Executable predicates, entity keys, time window, cardinality, ordered correlation, suppression, and benign/false-positive cases.
- Correct Sigma metadata: `status: stable` only if lifecycle evidence supports it; `level: critical` only if impact warrants it.
Evidence required: telemetry samples or schema, retention/clock/collection evidence, executable backend validation, offline fixtures showing expected matches and exclusions, scope reference, skill/version/source, observation time, authorization, and runtime-control evidence. Do not claim analytic coverage or production readiness until these are recorded.
