Cyber Detection Engineering

---
name: cyber-detection-engineering
guardrail: true
description: Designs and reviews detections from telemetry prerequisites, correlation logic, Sigma metadata, severity, status, and benign cases. Use for detection rules, Sigma review, analytic coverage, or tuning; not generic logging advice or live deployment.
metadata:
  triggers:
    files: []
    keywords:
      - detection engineering
      - detection rule
      - Sigma rule
      - analytic coverage
      - telemetry prerequisite
      - false positive tuning
---
# Cyber Detection Engineering

## **Priority: P0 (CRITICAL)**
Do not claim analytic coverage without required telemetry and executable support.

## Structure
Input: analytic question, behavior hypothesis, data source/fields, retention, clock quality, scope. Process: define predicates, entity keys, window, cardinality, ordered correlation, suppression, benign cases. Output: rule/spec, prerequisites, severity, lifecycle status, fixtures, limitations, evidence record.

## Rules
- A missing source, field, retention, clock, or collection path makes coverage `blocked` or `not-tested`.
- Multi-step behavior requires ordered sequence correlation over related entities/events; never substitute Boolean OR across unrelated single events.
- Sigma `level` expresses impact/priority (`informational`, `low`, `medium`, `high`, `critical`). Sigma `status` expresses lifecycle (`stable`, `test`, `experimental`, `deprecated`). A valid portable rule does not prove backend execution or telemetry.
- Record expected matches, exclusions and benign/false-positive cases with rationale.
- Include scope reference; skill/version/source; observation time; status; evidence references; limitations; owner. Reuse shared skill IDs.
- Production queries or modifications require documented authorization and runtime-proven controls; offline fixtures only.

## Anti-Patterns
- Never write `severity: high` as Sigma metadata; use `level: high`.
- Never equate `level` with `status`, rule validity with execution, or synthetic matches with efficacy.
- Never hide missing telemetry by lowering priority or widening OR logic.

## References (lazy, primary)
- Sigma specification: https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html
- MITRE ATT&CK detection strategies: https://attack.mitre.org/detectionstrategies/
- Reuse `cyber-authorization`, `cyber-evidence`, `cyber-framework-mapping`.