implementing-siem-use-case-tuning
De la autor
Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy metrics in Splunk and Elastic
Instalare
npx skills add 26zl/cybersec-toolkit --skill implementing-siem-use-case-tuning -a claude-code
Se instalează în .claude/skills/implementing-siem-use-case-tuning/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
Vrei ca agentul să-ți propună skill-uri în timp ce scrii? Vezi cum folosești skill-urile din IDE.
Verificări de siguranță pe SKILL.md
- Include scripturi pe care nu le-am verificatScăzut
De ce 77
aiqbench calculează scorul de încredere din semnale publice. Nu este un audit de securitate, așa că citește un skill înainte să-l instalezi.
Skill-uri similare
Cele mai apropiate de acesta prin ce fac și când sunt folosite.
- siem-alerttonone-ai/tononeTune a SIEM alert — reduce false positives, add context, and improve analyst experience. Use when asked to "tune this alert", "we have too many false positives", or "improve alert quality".Productivitate★ 76
- security-detection-rule-managementelastic/agent-skillsCreate, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.OficialSecuritate★ 600
- scanner-tuningUnitOneAI/SecuritySkillsTunes vulnerability scanners to reduce false positives, optimize scan policies, and improve result accuracy. Covers false positive identification patterns, scan policy configuration, authenticated vs unauthenticated scanning tradeoffs, severity override criteria, plugin/check selection, scan scheduling, and result correlation across multiple scanners. Uses CVSS 4.0 for severity validation and CWE for vulnerability classification.Securitate★ 94
- siem-rulesUnitOneAI/SecuritySkillsGuides development of SIEM detection rules using KQL (Microsoft Sentinel) and SPL (Splunk) query languages, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user needs to write SIEM queries, tune alert thresholds, build correlation rules, or manage the detection rule lifecycle. Produces production-ready queries with detection logic patterns, threshold tuning guidance, and lifecycle management.Redactare★ 94
- building-detection-rules-with-sigma26zl/cybersec-toolkitBuilds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.Planificare★ 82
- siem-ruletonone-ai/tononeWrite SIEM detection rules for a threat or TTP — SIGMA format, MITRE mapping, and test cases. Use when asked to "write a SIGMA rule", "build a detection rule for this TTP", or "map a SIEM rule to MITRE".Testare★ 76
Note și recenzii
—
nicio recenzie
Ai încercat acest skill? Notează-l ca să-i ajuți pe alții. Autentifică-te
Discuție
Intră în discuție. Autentifică-te