Detection Rule Writer

Generates production-ready SIEM detection logic from a described threat scenario, including the detection rule in the target platform's syntax (Panther Python, Sigma, or KQL), tuning guidance to suppress false positives, test cases with matching and non-matching events, MITRE ATT&CK mapping, and an alert triage runbook. Use when translating a threat behavior, attack technique, or incident into a working detection rule for edge and network telemetry.