sota-detection-engineering SKILL.md skillA
sota-detection-engineering from martinholovsky/sota-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add martinholovsky/sota-skills/sota-detection-engineering@git:20261025.c05557fPins git:20261025.c05557f in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- martinholovsky/sota-skills
- Path
skills/sota-detection-engineering/SKILL.md- Versions recorded
- 7
- Latest version
- git:20261025.c05557f, committed Oct 25, 2026
- First version recorded
- Jun 17, 2026
- Size
- 12,278 bytes
- Repository stars
- 26
- License
- CC-BY-4.0
State-of-the-art detection engineering, SOC, threat hunting, and incident response (2026). Use when BUILDING detective controls or SOC capability — Sigma/YARA/Falco/Tetragon/Suricata rules, detection-as-code, MITRE ATT&CK coverage, SIEM detections, alert triage and SOAR, threat hunts, threat-intel, deception, IR playbooks, or adversary emulation — AND when AUDITING detection & IR posture (can we detect this? does this alert fire?). Owns DETECTIVE controls, SOC workflow, hunting, and IR…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# SOTA Detection Engineering, SOC & Incident Response ## Purpose Assume prevention fails. This skill builds and audits the layer that *notices*: detective controls, the SOC that triages them, the hunts that find what alerts miss, and the IR process that contains what hunts surface. One question defines success: > **When a real adversary acts inside your environment, does a high-fidelity > signal fire, reach a human (or automation) with the context to act, and drive > a bounded response — fast enough to matter?** Detection is engineering, not art. Detections are **code**: version-controlled, peer-reviewed, CI-tested, ATT&CK-mapped, FP-budgeted, and retired when stale. The dominant failure mode is not missing rules — it is **alert fatigue**: noise that buries the one true positive. Optimize signal-to-noise relentlessly. **Ownership boundary.** [`sota-observability`](../sota-observability/SKILL.md) owns the telemetry pipeline (logs, metrics, traces, SLOs, log shipping, retention plumbing). This skill owns turning that telemetry into *security* detections, the SOC workflow, hunting, …
Read the whole file at its exact version.
How to install
mdr add martinholovsky/sota-skills/sota-detection-engineering@sha256:f2489237066ef7b9The line at the top of this page pins the label git:20261025.c05557f, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_cm7cs2mvnmhqkxu4)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 7 versions of this file, between Jun 17, 2026 and Oct 25, 2026, about one every 22 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261025.c05557f latest | 2026-10-25 | c05557f | 12,278 B | A | view · diff |
| git:20261024.8dd2b0a | 2026-10-24 | 8dd2b0a | 12,259 B | A | view · diff |
| git:20261012.ae1b29b | 2026-10-12 | ae1b29b | 12,018 B | A | view · diff |
| git:20260925.054c2cb | 2026-09-25 | 054c2cb | 11,070 B | A | view · diff |
| git:20260704.67df0cc | 2026-07-04 | 67df0cc | 10,902 B | A | view · diff |
| git:20260629.bacf523 | 2026-06-29 | bacf523 | 10,363 B | A | view · diff |
| git:20260617.c5d2c7b | 2026-06-17 | c5d2c7b | 10,721 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (12278 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
martinholovsky/sota-skills · 26 stars · license CC-BY-4.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_cm7cs2mvnmhqkxu4 GET https://markdownregistry.com/api/v1/resolve?ref=martinholovsky/sota-skills/sota-detection-engineering GET https://markdownregistry.com/api/v1/blob/f2489237066ef7b9be7a1224f74e832c5d57f7007891a9377c937b70095cfcf2
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.