skywatch-triage-rule-hits

Automating Osprey rule triage involves sampling execution data and classifying outcomes to identify rule drift and false positive patterns. This skill streamlines the process by pulling representative hit samples and generating actionable rule maintenance recommendations.

Classifying false positives during rule validation requires a structured framework to categorize hits as true positives, novel patterns, or uncertain. This skill provides a built-in classification schema with pattern grouping to systematically assess rule behavior over a specified time window.

Yes, analyzing rule drift and false positive patterns requires access to osprey_execution_results. The skill uses this execution data to perform aggregate statistical analysis and generate comprehensive triage summaries for ongoing maintenance workflows.

Yes, you can stratify sampling for Osprey rules across a specific time window. The skill automatically pulls representative hit samples to ensure accurate rule behavior analysis, such as analyzing 50 hits over the past 30 days.

Osprey rule validation requires integration with data-analyst dispatch tools to perform aggregate statistical analysis on sampled execution data. This integration enables the automated classification of outcomes and the generation of comprehensive rule health status reports.

After assessing Osprey rule health status, the skill generates a comprehensive triage summary with specific recommendations for rule maintenance or evolution. These actionable reports help identify novel detection opportunities and correct rule drift.