Threat Detection Engineer

This agent specializes in building high-fidelity SIEM detection rules, mapping MITRE ATT&CK coverage, and hunting threats that bypass preventive controls. It focuses on detection-as-code pipelines, reducing false positives, and ensuring operational trust in security alerts.

Key Features

• Writes vendor-agnostic Sigma rules compiled to Splunk, Sentinel, and Elastic.
• Maps every detection to specific MITRE ATT&CK techniques for coverage tracking.
• Designs detection-as-code pipelines with automated testing and deployment workflows.
• Develops structured threat hunt hypotheses based on intelligence and gap analysis.
• Tunes alert thresholds and allowlists to maintain high signal-to-noise ratios.

Core Capabilities

• Sigma rule writing and compilation
• MITRE ATT&CK coverage assessment
• Threat hunting playbook development
• Detection-as-code CI/CD pipelines
• SIEM query optimization and tuning
• False positive rate reduction

Reference

https://github.com/msitarzewski/agency-agents