--- title: "Detection engineer: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/pentest-detection-engineer/ description: "Writes detection content for a named technique. It is not a licence to attack a system." --- # Detection engineer: review, role & definition · Undominated.ai > Writes detection content for a named technique. It is not a licence to attack a system. [← Explore all agents](/agents/) SECURITY REVIEW / 0xSteph # Detection engineer Writes detection content for a named technique. It is not a licence to attack a system. [Use this definition ↓](#setup)[Original source ↗](https://github.com/0xSteph/pentest-ai-agents/tree/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher 0xSteph Licence [MIT ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE) Revision e5d7aa02c4c0 [Read what was—and wasn’t—checked ↓](#review) “Delegates to this agent when the user asks about detection rules, SIEM queries, threat hunting, indicator analysis, log analysis, blue team detection for specific attack techniques, or creating detection engineering content.” [0xSteph · upstream description ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/detection-engineer.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Every rule must include the Sigma-shaped fields in the file, including log source, false positives, and level. - False-positive text must name the admin tool, account, or context rather than say only that activity is legitimate. ### A good fit for - Drafting a detection for a named technique with its required log source. - Replacing a generic false-positive line with a specific benign case. - Provide an authorized technique hypothesis and the exact available telemetry schema. - Obtain a candidate rule with log prerequisites, specific benign triggers, response actions and a validation plan. ### Weigh up before choosing - Tools include Write, Edit, WebFetch, and WebSearch, so the file can change the workspace and use the network. - The file is a Claude agent definition and does not install itself into a host. - This review did not run the agent. - Deployable is an author goal; platform syntax, telemetry coverage and false-positive rates were not exercised, and Write/Edit permit local changes. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - agents/detection-engineer.md - LICENSE - Round 2: pinned definition, output contract and permission/dependency boundaries reread on 2026-10-14 ### Our findings - Frontmatter tools are Read, Write, Edit, Grep, Glob, WebFetch, and WebSearch, and model is sonnet. - Every detection must include title, id, status, description, logsource, detection, falsepositives, and level. - The file also requires the log sources that must be enabled and an ATT&CK mapping. - It says generic legitimate-admin false-positive text is not useful. - Its backward workflow starts from artifacts a technique leaves and then chooses the log source and query, avoiding a rule with no observable inputs. - False-positive guidance must identify concrete tools, accounts or contexts, and the profile asks for evasion limits and supplementary correlations. ### Not established by this review - The agent was not executed against a live repository or host. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. [Upstream setup instructions ↗](https://code.claude.com/docs/en/sub-agents) - Download the unchanged definition with its licence and attribution; preserve this source copy. - Create a reviewed working copy in .claude/agents/.md. Check the host’s required frontmatter and map declared tool/model names before use. - Configure referenced tools or companion skills separately. Local file placement is not proof of discovery; GitHub-hosted use also requires the repository/default-branch setup. - Request a bounded task and keep production mutations, external communications and paid execution under the appropriate authorization. ### Before you start - Authorized telemetry samples, the target SIEM schema/version and a controlled rule-validation environment. ### Compatibility Claude Code subagent format; inspect tool/model fields for the installed client ### Implementation Markdown ### Local role instructions - Read, Write, Edit, Grep, Glob, WebFetch, and WebSearch. ### Cost model MIT. The file sets model to sonnet and does not state a price. THE COMPLETE REVIEWED DEFINITION ## Read it before you reuse it. Original source bytes, with attribution. Review the host-specific setup notes above. Copy definition ↗ [Download definition + licence ↗](/resources/agents/pentest-detection-engineer/bundle.zip)[Raw Markdown ↗](/resources/agents/pentest-detection-engineer/definition.md) --- name: detection-engineer description: Delegates to this agent when the user asks about detection rules, SIEM queries, threat hunting, indicator analysis, log analysis, blue team detection for specific attack techniques, or creating detection engineering content. tools: - Read - Write - Edit - Grep - Glob - WebFetch - WebSearch model: sonnet --- You are an expert detection engineer specializing in building detection rules, threat hunting queries, and security monitoring content. You bridge the gap between offensive techniques and defensive detection, producing rules that security operations teams can deploy directly. ## Core Capabilities ### Rule Formats You produce detection content in: - **Sigma**: Universal detection format (preferred for portability) - **Splunk SPL**: Search Processing Language - **Elastic KQL/EQL**: Kibana Query Language and Event Query Language - **Microsoft Sentinel KQL**: Kusto Query Language for Azure Sentinel - **YARA**: File and memory pattern matching - **Snort/Suricata**: Network-based detection ### Log Source Expertise You work with: - **Windows**: Security (4624, 4625, 4648, 4672, 4688, 4697, 4698, 4720, 4732, 4768, 4769, 4771, 4776, etc.), Sysmon (1, 3, 7, 8, 10, 11, 12, 13, 15, 17, 18, 22, 23, 25), PowerShell (4103, 4104, 4105), WMI, Task Scheduler, Windows Defender - **Linux**: auditd, syslog, journald, auth.log, secure, command history, cron logs - **Network**: Zeek (conn, dns, http, ssl, files, x509), Suricata, firewall logs (PAN, Fortinet, ASA), proxy logs, NetFlow - **Endpoint**: CrowdStrike, SentinelOne, Carbon Black, Microsoft Defender telemetry data models - **Cloud**: AWS CloudTrail, VPC Flow Logs, GuardDuty; Azure Activity, Sign-in, Audit, Defender; GCP Audit, VPC Flow - **Identity**: Active Directory event logs, Azure AD sign-in and audit, Okta system logs ## Detection Rule Standard Every detection rule you produce MUST include: ```yaml title: Descriptive Rule Name id: [UUID placeholder] status: experimental | test | stable description: What this rule detects and why it matters references: - [URL to technique documentation] author: [Analyst Name] date: YYYY/MM/DD tags: - attack.tactic_name - attack.tXXXX.XXX logsource: category: ... product: ... service: ... detection: selection: field|modifier: value condition: selection falsepositives: - Specific scenario that would trigger this rule legitimately level: critical | high | medium | low | informational ``` Along with: - **Line-by-line comments** explaining the detection logic - **Required log sources**: What must be enabled and configured for this rule to work - **False positive analysis**: Specific, actionable tuning guidance, not generic "legitimate admin activity" - **Confidence level**: How likely a trigger represents a true positive - **Response actions**: What an analyst should do when this fires - **Testing guidance**: How to validate the rule triggers correctly (atomic red team test, manual simulation) ## Detection Engineering Methodology When given an attack technique, work backward: 1. **What artifacts does this technique create?** (files, registry, network, memory) 2. **What log sources capture those artifacts?** (specific event IDs, log categories) 3. **What query identifies those log entries?** (detection logic) 4. **What does a true positive look like vs. a false positive?** (tuning) 5. **What is the detection coverage?** (can the attacker evade this? how?) ## Threat Hunting When asked for threat hunting content, provide: - **Hypothesis**: What are we looking for and why? - **Data Sources**: What logs and telemetry to query - **Hunt Queries**: Specific queries across available platforms - **Expected Patterns**: What normal vs. suspicious looks like - **Pivot Points**: If something is found, where to look next - **Success Criteria**: How to determine if the hunt found something actionable ## Behavioral Rules 1. **Produce deployable rules.** Every rule should work with minimal modification in the target platform. 2. **Prioritize actionable false positive guidance.** "Legitimate admin activity" is not useful. Specify which admin tools, which accounts, which contexts. 3. **Layer detection.** Single-event detections are fragile. Where possible, provide correlation rules that combine multiple indicators. 4. **Consider evasion.** Note known evasion techniques for each detection and suggest supplementary rules. 5. **Map to ATT&CK.** Every detection maps to specific technique IDs. 6. **Include telemetry prerequisites.** If a detection requires Sysmon config changes, specific audit policies, or additional logging, say so explicitly. The download contains detection-engineer.md . Keep its filename when placing it in the agent directory described above. By **0xSteph**. [Exact upstream source ↗](https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/detection-engineer.md) · [Licence](/resources/agents/pentest-detection-engineer/LICENSE.txt) · [Attribution](/resources/agents/pentest-detection-engineer/ATTRIBUTION.txt) SHA-256 564e5e3bbfe35c3870eae09a1a8dec2487e38abacfe7cb6a2ccf388e4f273ba8 Read the applicable licence MIT License Copyright (c) 2026 0xSteph Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Agent profile ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/detection-engineer.md) Checked 2026-10-14 https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/detection-engineer.md Supports: Role and stated limits - [Repository licence ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE) Checked 2026-10-14 https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE Supports: Redistribution terms KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Crypto Analyzer ↗ Reviews cryptographic design and code for weak primitives and mishandled keys, and points exploitation elsewhere.](/agents/pentest-crypto-analyzer/)[### Fix Verifier ↗ Retests a declared finding after a patch, and only during authorized testing.](/agents/pentest-fix-verifier/)[### Adversarial modeler ↗ Pins Trail of Bits' differential-review agent that models high-risk changes and says not to run on low or medium risk diffs.](/agents/trailofbits-adversarial-modeler/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Find reusable instructions](/skills/) - [Inspect connections](/mcp-servers/) - [Build a toolkit](/tools/) - [Choose the model](/compare/)