siem-rules

What problem does it solve?

This Skill helps security teams develop, refine, and manage SIEM detection rules to identify cyber threats promptly.

Core Features & Use Cases

• Rule Development: Guides creation of detection queries in KQL (Microsoft Sentinel) or SPL (Splunk) for various attack techniques.
• Tuning and Optimization: Provides best practices for threshold setting and reducing false positives.
• Lifecycle Management: Assists in monitoring, updating, and deprecating detection rules to maintain detection coverage and effectiveness.
• Use Case: A security analyst wants to craft a detection rule for brute-force login attempts and periodically tune its thresholds based on the environment baseline.

Quick Start

Generate a detection query to identify multiple failed logins from the same IP in the last 10 minutes.