skills.rest
do360now
do360nowCOMMUNITY
Explore all skills by this author →
Website𝕏@machadoclementGitHub

siem-rules

Design and tune SIEM detection rules for Azure Sentinel or Splunk.

Updated Apr 19, 2026
Search Tags:#detection#threat detection#rules#tuning#siem#log analytics
One-click install
npx skills add https://github.com/do360now/security-agents --skill siem-rules
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: siem-rules
Source: https://github.com/do360now/security-agents/tree/main/.claude/skills/siem-rules
Command: npx skills add https://github.com/do360now/security-agents --skill siem-rules

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps security teams develop, refine, and manage SIEM detection rules to identify cyber threats promptly.

Core Features & Use Cases

  • Rule Development: Guides creation of detection queries in KQL (Microsoft Sentinel) or SPL (Splunk) for various attack techniques.
  • Tuning and Optimization: Provides best practices for threshold setting and reducing false positives.
  • Lifecycle Management: Assists in monitoring, updating, and deprecating detection rules to maintain detection coverage and effectiveness.
  • Use Case: A security analyst wants to craft a detection rule for brute-force login attempts and periodically tune its thresholds based on the environment baseline.

Quick Start

Generate a detection query to identify multiple failed logins from the same IP in the last 10 minutes.

Frequently Asked Questions about siem-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write SIEM detection rules for brute-force login attempts in Azure Sentinel or Splunk?▼

SIEM detection rules for brute-force logins are built using KQL in Azure Sentinel or SPL in Splunk. This Skill provides guidance on crafting queries to identify multiple failed logins from the same IP within a specific timeframe to detect cyber adversaries.

What is the best way to tune SIEM rules and reduce false positives in log analytics?▼

Tuning SIEM rules involves adjusting thresholds and applying best practices based on your environment's baseline. This Skill guides threshold setting and query optimization to effectively reduce false positives while maintaining attack technique detection coverage.

Does this SIEM rules guidance work with both Microsoft Sentinel and Splunk environments?▼

Yes, the SIEM rules guidance supports both Microsoft Sentinel and Splunk environments. It provides tailored instructions for designing and managing detection queries using KQL for Sentinel and SPL for Splunk.

How do I manage the lifecycle of threat detection rules to maintain coverage over time?▼

Managing threat detection rules requires continuous monitoring, updating, and eventual deprecation. This Skill assists with lifecycle management to ensure your SIEM detection coverage remains effective against evolving cyber threats.

Can I use this for optimizing existing detection queries or is it only for new rule development?▼

You can use this for both new rule development and optimizing existing detection queries. It provides best practices for tuning thresholds and refining KQL or SPL queries to ensure effective threat identification across your environment.

Related Skills

AgentSecOpsAgentSecOps
183

detection-sigma

Create, validate, and translate Sigma rules for Splunk, Elasticsearch, and Sentinel backends.

Official
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-response

Automate security incident detection, classification, containment, investigation, and remediation in ServiceNow.

Official
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
UnitOneAIUnitOneAI
44

siem-rules

Develop KQL or SPL SIEM detection rules mapped to MITRE ATT&CK v16 techniques.

Official
Intermediate