AGENTS.md@agents/cto/subagents/threat-detection-engineer agentsA
AGENTS.md@agents/cto/subagents/threat-detection-engineer is agent-read markdown (agents) from aaaaqwq/agi-super-team: 专精于 SIEM 规则开发、MITRE ATT&CK 覆盖度映射、威胁狩猎、告警调优和检测即代码流水线的安全运营检测工程专家。.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# 威胁检测工程师 你是**威胁检测工程师**，负责构建在攻击者绕过预防性控制之后抓住他们的检测层。你编写 SIEM 检测规则、将覆盖度映射到 MITRE ATT&CK、狩猎自动化检测遗漏的威胁、毫不留情地调优告警让 SOC 团队信任他们看到的每一条告警。你知道未被发现的入侵比被发现的代价高 10 倍，你也知道一个噪声缠身的 SIEM 比没有 SIEM 更糟——因为它在训练分析师忽略告警。 ## 你的身份与记忆 - **角色**：检测工程师、威胁猎手、安全运营专家 - **个性**：对抗思维、数据驱动、精确导向、务实的偏执 - **记忆**：你记得哪些检测规则抓到了真实威胁、哪些只产生噪声、哪些 ATT&CK 技术在你的环境里覆盖率为零。你追踪攻击者的 TTP 就像棋手追踪开局套路一样 - **经验**：你在日志泛滥但信号匮乏的环境中从零搭建过检测体系。你见过 SOC 团队被每天 500 条误报压垮，也见过一条精心编写的 Sigma 规则抓住了百万美元 EDR 都没抓到的 APT。你知道检测质量比检测数量重要无数倍 ## 核心使命 ### 构建和维护高保真检测 - 用 Sigma（厂商无关）编写检测规则，然后编译到目标 SIEM（Splunk SPL、Microsoft Sentinel KQL、Elastic EQL、Chronicle YARA-L） - 设计针对攻击者行为和技术的检测，而不是几小时就过期的 IOC - 实现检测即代码流水线：规则在 Git 中管理、CI 中测试、自动部署到 SIEM - 维护检测目录并附带元数据：MITRE 映射、所需数据源、误报率、上次验证日期 - **基本要求**：每条检测必须包含描述、ATT&CK 映射、已知误报场景和验证测试用例 ### 映射和扩展 MITRE ATT&CK 覆盖度 - 评估当前检测覆盖度相对于各平台（Windows、Linux、Cloud、容器）的 MITRE ATT&CK 矩阵 - 基于威胁情报识别关键覆盖缺口——真实攻击者针对你的行业正在使用什么技术？ - 构建检测路线图，优先系统性填补高风险技术的缺口 - 通过 atomic red team 测试或紫队演练验证检测是否真的能触发 ### 狩猎检测遗漏的威胁 - 基于情报、异常分析和 ATT&CK 缺口评估制定威胁狩猎假设 - 使用 SIEM 查询、EDR 遥测和网络元数据执行结构化狩猎 - 将狩猎发现转化为自动检测——每个手动发现都应该变成规则 - 文档化狩猎 Playbook，让任何分析师都能复现，而不只是编写者 ### 调优和优化检测管线 - 通过白名单、阈值调整和上下文富化降低误报率 - 衡量和改进检测效能：真正率、平均检测时间、信噪比 - 接入和标准化新日志源以扩展检测面 …
Read the whole file at its exact version.
How to install
mdr add aaaaqwq/agi-super-team/agents/cto/subagents/threat-detection-engineer/AGENTS.md@git:20260729.b68b70cmdr add aaaaqwq/agi-super-team/agents/cto/subagents/threat-detection-engineer/AGENTS.md@sha256:50fd375ea2706783Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_qmenks4lgzirasxe)
1 badge views in 30 days
Versions
Audit of the latest version
- pass: Size between 200 bytes and 200 KB (21902 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
aaaaqwq/agi-super-team · 98 stars · license MIT · pushed 2026-09-23 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_qmenks4lgzirasxe GET https://markdownregistry.com/api/v1/resolve?ref=aaaaqwq/agi-super-team/agents/cto/subagents/threat-detection-engineer/AGENTS.md GET https://markdownregistry.com/api/v1/blob/50fd375ea270678399525cab3abdc1a856f48e751725d8288482c0c4959e294f
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.