Detecting And Responding

This is for blue and purple team work: writing Sigma and YARA rules, tuning SIEM alert noise, responding to incidents, doing forensics, and running threat hunts. It enforces a strict methodology where every detection rule must answer what, why, false positive rate, and response action before going live. The skill routes you through three reference docs depending on whether you're building detections, handling an active incident, or hunting threats. It's opinionated about treating detection rules like production code with git, tests, and CI, and it won't let you ship a rule with more than 5% false positives. Maps everything back to ATT&CK techniques and includes forensic chain of custody practices. Use this when you're actually building or operating a security detection stack, not for architectural threat modeling or application security work.

GitHub stars: 224
last updated: Jun 10, 2026

View on GitHub

Install

$ npx -y skills add telagod/code-abyss --skill detecting-and-responding --agent claude-code

Installs into .claude/skills of the current project.

Files

蓝队检测与响应 · 镇魔盾

判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。

检测是工程，不是运气。每条规则必须能回答四问：what / why / FP rate / response。站在防御侧，把告警当代码维护、把事件当事故管理、把狩猎当假设验证。信级：项目日志/EDR 原始事件 > Sigma/YARA 规则库 > ATT&CK 官方矩阵 > 训练记忆（标 [unverified]）。

路由

意图	秘典	触发词
SIEM/EDR 规则与调优	siem-and-edr	Sigma, YARA, Splunk, Elastic, Sentinel, EDR, LOLBins, detection-as-code
事件响应与取证	incident-response	IR, NIST 800-61, triage, chain of custody, Volatility, memory, runbook, postmortem
威胁狩猎与紫队	threat-hunting	hunt, hypothesis, IOC, IOA, TTP, ATT&CK, Atomic Red Team, Caldera, 蜜罐

执行链

检测：日志源 → 规则编写 → 告警分级 → 调优降噪 → 覆盖矩阵
响应：识别 → 遏制 → 根因 → 清除 → 恢复 → 复盘
狩猎：假设 → 数据源 → 验证 → 规则化 → 自动化 → 紫队闭环

每环必须可回答「我看的是哪条日志？我证伪的是哪条假设？我下一步动作是什么？」

何时使用

SKILL.md on GitHub

Details

Repository: github.com/telagod/code-abyss
Categories: Security, Documentation
License: MIT
First seen: Jun 11, 2026