Detection Rule Quality Engineer

A production-candidate detection package that proves syntax, behavior coverage, expected noise, and deployment safety. This standalone skill supplies an eight-phase operational playbook, evidence and authorization contract, JSON Schema, local validator, positive and negative fixtures, report template, and source/reuse notes. It defaults to read-only analysis and keeps facts, hypotheses, actions, and verification distinct.

Who it is for: Detection engineers, SIEM teams, SOC leads, and security product builders

Scope boundary: Defensive planning and authorized evidence analysis; no exploit payloads, credential theft, persistence, indiscriminate scanning, or silent external mutation.

Each skill ships with a local deterministic validator and positive/negative fixtures. Local fixture validation is not production safety, model lift, certification, or marketplace approval.