All authors
Claude Skills by WRG-11
github.com/WRG-116 skills0 installs4 views
- Sigma Rule ReviewerReview an existing Sigma rule for parseability, detection quality, false positives, and backend conversion constraints.Votes: 0GitHub stars: 2
- Sigma Rule WriterDraft a Sigma detection rule from a threat description, then validate it before suggesting any backend conversion.Votes: 0GitHub stars: 2
- Threat Coverage Gap AnalyzerAnalyze Sigma rules against MITRE ATT&CK and prioritize defensible detection coverage gaps.Votes: 0GitHub stars: 2
- Sigma Rule ReviewerReview an existing sigma rule for spec compliance, detection quality, and improvement opportunities. Use when the user pastes a sigma YAML rule, asks "is this rule any good", asks for a code review on a detection, or wants to harden a rule against false positives. Runs pySigma validation, best-practices linter, and produces a structured findings report with concrete fix suggestions.Votes: 0GitHub stars: 2
- Sigma Rule WriterGuided sigma detection rule writing from a natural language threat description. Use when the user asks to write a sigma rule, SIEM detection rule, EDR alert logic, or any "detect when X happens" question. Asks clarifying questions (logsource, MITRE ATT&CK TTP, severity), drafts YAML via mcp__plugin_wrg-sigma-rules_wrg-sigma-rules__draft_rule, validates via mcp__plugin_wrg-sigma-rules_wrg-sigma-rules__validate_rule, and offers backend conversion.Votes: 0GitHub stars: 2
- Threat Coverage Gap AnalyzerAnalyze a Sigma rule corpus and produce an evidence-bounded coverage report. Use when the user asks "what TTPs am I missing", asks for a coverage report, wants to compare detections against a supplied ATT&CK matrix or actor profile, or wants defensible candidates for further research. Reads a directory of Sigma rules (or, for this plugin's own corpus, the precomputed wrg-sigma://coverage/mitre-attack-matrix resource), then compares only against user-supplied, versioned scope data.Votes: 0GitHub stars: 2