Detection Skills
Detection Skills is an open standard for the Agentic SOC, that transforms static detections into agentic workflows. Designed and used by Cyber Defense Engineers, it brings the best your team can do - to every alert.
What are Detection Skills?
Just as Sigma defined the traditional detection rule format, Detection Skills is what comes next for AI-first Cyber Defense teams. The engineer who builds a detection and the analyst who responds to its alerts at 2 a.m. often never meet, and the context dies in the handoff.
Detection Skills solves that: built on the Agent Skills framework originally developed by Anthropic, it attaches triage, investigation, and tuning directly to the detection, so the reasoning travels with it, enabling security teams to:
Detect and decide at AI speed
Triage and investigation agents run automatically the moment a detection fires, slashing MTTD and MTTR. Only what matters reaches a human, with a finished, evidence-backed workbook attached.
Scale cyber defense expertise
Author a skill once with the queries and context an investigation needs and the same judgment reaches every alert. Engineers keep complete transparency and control over the AI's reasoning: what it checked, why it decided, and no change happenswithout their sign-off.
Cross-detection reuse
Write a skill once (identity context, GeoIP enrichment, a known-VPN check) and call it from any detection that needs it. Improve it in one place; every detection benefits.
impossible_travel
user: john.doe
2026-07-23 14:02 UTC
2 countries in 42 minutes
skill: impossible-travel-skill
→ decision: escalate
alert + full context
skill: oauth-consent-phishing
→ verdict: malicious
consumed by human
→ exclude: corp vpn ASN
skill: impossible-travel-tuning
How do Detection Skills work?
When the detection’s trigger matches, an agent runs the skills attached to it. The workflow has three phases, each a skill with a defined contract for what it returns:
The human stays in the loop by design: every dismissal is logged and reversible, tuning only ever proposes changes for review rather than editing detections in place, and escalations route to an analyst queue.
Why an open standard?
Most detections aren't unique to your organization — a CloudTrail finding, a SaaS misconfiguration, a known technique. Triage looks much the same everywhere, and no team should have to reinvent it. An open format lets the community build and share that work as open-source skills you can run as-is.
The detections that matter most are usually specific to your environment. For these, a team authors its own skill — or forks a community one — and keeps it private. Because a Detection Skill is just a folder in a common format, both live side by side, reviewed and versioned the same way.
Built on Agent Skills
The same format as Agent Skills — a folder with a SKILL.md for metadata and instructions — so anything that runs Agent Skills can run a Detection Skill. Stewarded by Vega, released as an open format for the cyber defense community: free to adopt, extend, and contribute to.