Installs into .claude/skills of the current project.
Are you the author of Sigma Rule Reviewer?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/wrg-11-sigma-rule-reviewer)
---
name: sigma-rule-reviewer
description: Review an existing Sigma rule for parseability, detection quality, false positives, and backend conversion constraints.
---
# Sigma Rule Reviewer
Read the supplied YAML or requested file, then call the `wrg-sigma-rules`
MCP server's `validate_rule`. Report parse errors separately from quality
warnings. Explain what the detection actually selects, its required telemetry,
and one realistic benign trigger. Do not silently rewrite the rule; show a
small diff and revalidate only if the user requests changes.
Treat `falsepositives` placeholders and leftover `REPLACE_ME` markers as
actionable findings. A correlation rule failing for a Lucene-family backend
is a backend capability limitation, not proof that the Sigma rule is invalid.
A converted correlation rule carries `correlation_semantics`; relay each entry,
because it names where the query stops meaning the rule (a dropped window, an
unenforced order, a query that cannot reach its threshold).
A successful conversion is syntax evidence only; do not claim deployed-SIEM
semantic equivalence or production readiness without target-side validation.
