implementing-siem-use-case-tuning
From the author
Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy metrics in Splunk and Elastic
Install
npx skills add 26zl/cybersec-toolkit --skill implementing-siem-use-case-tuning -a claude-code
Installs to .claude/skills/implementing-siem-use-case-tuning/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- siem-alerttonone-ai/tononeTune a SIEM alert — reduce false positives, add context, and improve analyst experience. Use when asked to "tune this alert", "we have too many false positives", or "improve alert quality".Productivity★ 76
- security-detection-rule-managementelastic/agent-skillsCreate, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.OfficialSecurity★ 600
- scanner-tuningUnitOneAI/SecuritySkillsTunes vulnerability scanners to reduce false positives, optimize scan policies, and improve result accuracy. Covers false positive identification patterns, scan policy configuration, authenticated vs unauthenticated scanning tradeoffs, severity override criteria, plugin/check selection, scan scheduling, and result correlation across multiple scanners. Uses CVSS 4.0 for severity validation and CWE for vulnerability classification.Security★ 94
- siem-rulesUnitOneAI/SecuritySkillsGuides development of SIEM detection rules using KQL (Microsoft Sentinel) and SPL (Splunk) query languages, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user needs to write SIEM queries, tune alert thresholds, build correlation rules, or manage the detection rule lifecycle. Produces production-ready queries with detection logic patterns, threshold tuning guidance, and lifecycle management.Writing★ 94
- siem-loggingancoleman/ai-design-componentsConfigure security information and event management (SIEM) systems for threat detection, log aggregation, and compliance. Use when implementing centralized security logging, writing detection rules, or meeting audit requirements across cloud and on-premise infrastructure.Security★ 525
- building-detection-rules-with-sigma26zl/cybersec-toolkitBuilds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.Planning★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in