Guide · Agent skill
How to use the Building Sigma Detection Rules agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the building-detection-rules-with-sigma agent skill, which helps an AI agent write detection rules in Sigma, an open format that describes suspicious activity in logs without tying the rule to one vendor. It is aimed at security operations staff who want one rule that can be turned into queries for several SIEM products. After reading, you will know how to install the skill, how to ask for Sigma work in plain language, and what you need in place before the output is useful.
Building Sigma Detection Rulesmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Install the skill. Unzip it into ~/.claude/skills/ for personal use or .claude/skills/ in a project, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install Python packages. Install Python 3.8 or newer, then run pip install pySigma pySigma-validators-sigmaHQ and the backend packages for your SIEM.
- 4Ask for a rule. Describe the behaviour to detect, the log source and the target SIEM in plain language.
- 5Validate and convert. Ask the agent to run sigma check on the rule and convert it to your SIEM query language.
- 6Test before deploying. Check the rule against sample events and run it in a non-alerting saved search before enabling alerts.
What the skill makes the agent do
Once installed, the agent helps security teams write detection rules in Sigma. It can validate a rule, convert it into queries for platforms such as Splunk, Elastic and Microsoft Sentinel, tag it with MITRE ATT&CK technique IDs, and load a folder of rules to build a coverage map.
The skill includes a Python helper script (scripts/agent.py) that uses the pySigma library to parse and convert rules.
- Write a Sigma rule from a threat report or ATT&CK technique
- Validate rule syntax with the sigma check command
- Convert a rule to Splunk SPL, Elastic Lucene or Microsoft Sentinel KQL
- Tag rules with ATT&CK technique IDs and build a coverage layer from a rules folder
Install the skill (ZIP download or Claude upload)
Download the skill ZIP from this page. You can install it in one of two ways.
For a personal install, unzip the file into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, then Capabilities, then Skills, and upload the ZIP there.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Set up the Python tools the skill needs
The skill needs Python 3.8 or newer. Install pySigma with the validators package, which provides the sigma check command. The backend packages for Splunk, Elasticsearch and Microsoft 365 Defender are also required for conversion.
If you want community rules from the SigmaHQ project, clone the sigma repository. This is optional.
- Python 3.8+
- pySigma and backends: pySigma-backend-splunk, pySigma-backend-elasticsearch, pySigma-backend-microsoft365defender
- pySigma-validators-sigmaHQ for the sigma check command
- Optional: a local clone of the SigmaHQ sigma repository for community rules
pip install pySigma pySigma-validators-sigmaHQ
sigma check rule.yml
git clone https://github.com/SigmaHQ/sigma.gitTrigger the skill with natural requests
You do not need special syntax. Describe the detection you want in plain language and mention Sigma, a SIEM, or ATT&CK. The skill's description says it applies when you create portable detection logic from threat intelligence, map rules to ATT&CK techniques, or convert community Sigma rules into platform-specific queries.
Give the agent the context it cannot guess: the log source (for example Sysmon process access on Windows), the target SIEM, and any known false positives.
- "Write a Sigma rule for LSASS credential dumping using Sysmon process_access logs."
- "Validate this rule.yml and tell me what the sigma check output means."
- "Convert this rule to Splunk SPL and Elastic Lucene."
- "Tag this rule with the right ATT&CK technique IDs."
- "Build an ATT&CK Navigator coverage layer from my Sigma rules folder."
Check the output before you deploy it
Validation and conversion are the start of the work, not the end. The skill's workflow says to test the rule against sample data that contains the events it should catch, and to measure false positives by running it against production data in a non-alerting saved search before turning on alerts.
Converted queries depend on your log source field mappings. Check that the field names in the output match what your SIEM actually stores.
- Run sigma check and fix any reported issues
- Test against sample events, including the events it should catch
- Run in a non-alerting saved search before enabling alerts
- Store rules in version control and run validation in CI/CD
from sigma.rule import SigmaRule
from sigma.validators.core import SigmaValidator
rule = SigmaRule.from_yaml(open("rule.yml").read())
validator = SigmaValidator()
issues = validator.validate_rule(rule)
for issue in issues:
print(f"{issue.severity}: {issue.message}")Safety notes: scripts and network access
The skill runs scripts: its helper script at scripts/agent.py is a Python program that parses and converts rules. Review the script before you install the skill in a shared environment.
The skill does not use the network, according to its listing. Only the optional sigma repository clone and pip installs require internet access.
- Read scripts/agent.py before installing in a shared or production environment
- The skill itself uses no network access; the setup steps above do
What people use it for
- Writing one Sigma rule for credential dumping and converting it to Splunk SPL and Elastic queries
- Turning a threat report's ATT&CK techniques into searchable detections with tags
- Building an ATT&CK Navigator coverage layer from a folder of Sigma rules
- Standardising existing vendor-specific rules into a shareable Sigma format for detection-as-code
Frequently asked questions
Is the Sigma detection rules skill free?
The skill is licensed under Apache-2.0, as listed on this page. Sigma and the pySigma packages are separate open projects, and you should check their own licence terms before use.
What do I need to run the Sigma detection rules skill?
You need Python 3.8 or newer, pySigma with the Splunk, Elasticsearch and Microsoft 365 Defender backends, and pySigma-validators-sigmaHQ for the sigma check command. A local clone of the SigmaHQ repository is optional. You also need access to a SIEM and log sources to test converted queries meaningfully.
Can the skill handle real-time streaming detection?
No. The skill states that Sigma is for batch or scheduled searches, so do not use it for real-time streaming detection.
Can Sigma express Splunk RBA risk scoring?
No. The skill notes that vendor-native features such as Splunk RBA risk scoring cannot be expressed in Sigma, so those detections should be built natively in the SIEM.
How do I install an agent skill from a ZIP file?
Unzip the file into ~/.claude/skills/ for personal use or into .claude/skills/ in a project folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
How does this compare with writing SIEM queries by hand?
The skill lets you write the detection once in Sigma and convert it to several SIEM query languages, which helps when you run more than one platform. Hand-written queries are still the better choice for detections that depend on vendor-native features.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a SOC engineer or detection team that wants one rule format across several SIEMs, or you store detections in version control. Pick something else if you need real-time streaming detection, rely on vendor-native features such as Splunk RBA, or do not have a SIEM and log sources to test against.
Download the skill