Skip to main content
S

/siem-rule

Siembuild

Write SIEM detection rules for a threat or TTP: SIGMA format, MITRE mapping, and test cases.

Install

This skill

Install Siem Rule

1. Add to marketplace

$ claude plugin marketplace add tonone-ai/tonone

2. Install this skill

$ claude plugin install siem-rule@tonone-ai

The agent

Install Siem

1. Add to marketplace

$ claude plugin marketplace add tonone-ai/tonone

2. Install Siem

$ claude plugin install siem@tonone-ai
See all Siem skills

Want all 100 agents across both teams?

Full installation guide

Invoke this skill

Command|$ /siem-rule

When to use

Write SIEM detection rules for a threat or TTP: SIGMA format, MITRE mapping, and test cases.

More from Siem

All Siem skills
Siembuild

/siem-alert

Tune a SIEM alert: reduce false positives, add context, and improve analyst experience.

Tune a SIEM alert: reduce false positives, add con…
Siemrecon

/siem-recon

Audit existing SIEM deployment: log coverage, rule quality, and alert volume.

Audit existing SIEM deployment: log coverage, rule…

Ready to use Siem Rule?

Get StartedBack to Marketplace