Threat Hunting with Sigma Rules

This skill uses Sigma detection rules — a vendor-neutral format for describing log-based threat signatures — to hunt for suspicious activity and analyze security events.

Why a skill for this

Sigma’s rule format is expressive but verbose to write and match by hand across large event logs. A skill that already knows the format turns threat hunting into a repeatable query task instead of a manual log-reading exercise.

Good for

Security teams doing log-based threat hunting who want Sigma rule matching without hand-rolling the query logic each time.