Detection Engineering

unitoneai/detection-engineering

> Guides creation of detection rules using Sigma rule specification and the Palantir Alerting and Detection Strategy (ADS) framework, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user discusses detection logic, Sigma rules, ATT&CK coverage gaps, or asks "how do I detect this technique?" Produces Sigma-formatted detection rules, ADS documentation, and coverage heatmap methodology for systematic detection program management.