skills.rest
refractionPOINT
refractionPOINTOFFICIAL
Explore all skills by this author →
WebsiteGitHub

fp-pattern-finder

Detect false positive patterns in historic detections and generate narrow FP rules for approval.

29|3|Updated Dec 21, 2025
Search Tags:#automation#detection#rules#false positives#fp-pattern
One-click install
npx skills add https://github.com/refractionPOINT/lc-ai --skill fp-pattern-finder
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fp-pattern-finder
Source: https://github.com/refractionPOINT/lc-ai/tree/main/marketplace/plugins/lc-essentials/skills/fp-pattern-finder
Command: npx skills add https://github.com/refractionPOINT/lc-ai --skill fp-pattern-finder

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automatically detects false positive patterns in detections using deterministic analysis, generates narrow FP rules, and presents findings for user approval before deployment.

Core Features & Use Cases

  • Automatic detection of FP patterns (e.g., single-host concentration, identical commands)
  • Generated FP rules tuned for specificity
  • Parallel investigation of patterns to speed up tuning

Quick Start

Retrieve historic detections, run pattern detection, and review proposed FP rules for approval.

Frequently Asked Questions about fp-pattern-finder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect false positive patterns in my detections?▼

False positive pattern detection analyzes historic detections within a specified time window to identify patterns like single-host concentration, temporal periodicity, and identical commands. The Skill uses deterministic analysis to surface these patterns automatically, then generates narrow FP rules for your review before deployment.

What types of false positive patterns can this Skill identify?▼

The Skill detects patterns including single-host concentration, temporal periodicity, identical command lines, admin tool paths, and other deterministic indicators. Each pattern is analyzed in parallel to speed up tuning and rule generation.

How are false positive rules generated and deployed?▼

Generated FP rules are tuned for specificity and presented for explicit user approval before deployment. The Skill enforces an investigation-before-rule workflow to ensure data accuracy and prevent rule fabrication, delivering reliable FP suppression.

What data do I need to use this Skill?▼

Retrieve historic detections within your desired time window. The Skill analyzes this detection data to identify patterns and generate narrow rules; no additional dependencies or components are required.

Can this Skill work with detections across multiple hosts?▼

Yes. The Skill identifies patterns like single-host concentration but also analyzes broader temporal and behavioral patterns across your detection dataset to generate appropriately scoped FP rules.

Related Skills

Explore More Data & Analytics Skills→
htafollahtafolla
5

log-monitor

Analyze log streams, detect patterns, and trigger threshold-based alerts.

Community
Intermediate
refractionPOINTrefractionPOINT
29

detection-tuner

Identify noisy security detections and generate approved false positive suppression rules.

Official
Advanced
googlegoogle
513

secops-triage

Triage security alerts and cases using the Alert Triage Protocol.

Official
Intermediate
QcasaresQcasares

data-anomaly-detector

Detect anomalies in construction data using statistical methods and machine learning.

Community
Advanced