- Metadata defect: `severity: high` is invalid Sigma metadata. Use `level: high`; `level` expresses impact/priority. - `status: experimental` is valid lifecycle metadata, but does not establish execution readiness. - Readiness: `blocked` / `not-tested`. Required process telemetry is not collected, so analytic coverage cannot be claimed and the rule cannot be validated. Collect and verify the required process source/fields, retention, collection path, and clock quality; then test with offline ...
Installs into .claude/skills of the current project.
Are you the author of Cyber Detection Engineering?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-detection-engineering-f6ba5038)
- Metadata defect: `severity: high` is invalid Sigma metadata. Use `level: high`; `level` expresses impact/priority.
- `status: experimental` is valid lifecycle metadata, but does not establish execution readiness.
- Readiness: `blocked` / `not-tested`. Required process telemetry is not collected, so analytic coverage cannot be claimed and the rule cannot be validated.
Collect and verify the required process source/fields, retention, collection path, and clock quality; then test with offline fixtures and document evidence, benign cases, limitations, scope, owner, and status.
