sigma-rule-writer

Guided sigma detection rule writing from a natural language threat description. Use when the user asks to write a sigma rule, SIEM detection rule, EDR alert logic, or any "detect when X happens" question. Asks clarifying questions (logsource, MITRE ATT&CK TTP, severity), drafts YAML via mcpplugin_wrg-sigma-rules_wrg-sigma-rulesdraft_rule, validates via mcpplugin_wrg-sigma-rules_wrg-sigma-rulesvalidate_rule, and…