skills.rest
jaskaranhundal
jaskaranhundalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

telemetry-signal-quality

Normalizes raw security events into typed, attributed, confidence-scored SecurityFact objects.

3|3|Updated Mar 8, 2026
Search Tags:#data quality#normalization#telemetry#confidence scoring#detection engineering#security logs
One-click install
npx skills add https://github.com/jaskaranhundal/usap-skills --skill telemetry-signal-quality
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: telemetry-signal-quality
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/detection/telemetry-signal-quality
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill telemetry-signal-quality

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill ensures that security detections and investigations are based on accurate, complete, and high-fidelity telemetry data, preventing false negatives due to data pipeline issues.

Core Features & Use Cases

  • Telemetry Normalization: Standardizes diverse security event logs into a controlled vocabulary of event types and severity levels.
  • Signal Quality Assessment: Assigns confidence scores to telemetry based on source credibility and signal specificity.
  • Deduplication: Identifies and flags duplicate events to prevent alert fatigue and ensure data integrity.
  • Use Case: When a new security alert fires, this Skill first validates that the underlying logs from the source (e.g., EDR, firewall) are healthy and correctly formatted before the alert is acted upon.

Quick Start

Normalize the provided raw security log data into a structured SecurityFact object.

Frequently Asked Questions about telemetry-signal-quality

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I normalize raw security logs into a standardized format for detection engineering?▼

Normalize raw security logs by mapping diverse event types and severities into a controlled vocabulary, creating typed and attributed SecurityFact objects. This standardization ensures consistent telemetry data for security operations and accurate detection engineering.

What is telemetry signal quality assessment and how does confidence scoring work?▼

Telemetry signal quality assessment scores source credibility and signal specificity to assign confidence values to security events. Confidence scoring evaluates the reliability of telemetry sources to ensure security detections rely on high-fidelity data.

How do I deduplicate security events to prevent alert fatigue?▼

Deduplicate security events by identifying and flagging duplicate entries within telemetry pipelines. This prevents alert fatigue and maintains data integrity by ensuring security operations process only unique, actionable security facts.

Why do my security detections have false negatives caused by data pipeline issues?▼

False negatives often occur when security detections act on inaccurate or incomplete telemetry data. Validating that logs are healthy and correctly formatted before acting on alerts ensures security investigations are built on accurate, complete telemetry foundations.

Can I use telemetry normalization for logs from EDR and firewall sources?▼

Yes, telemetry normalization supports logs from sources like EDR and firewalls. It validates that underlying logs are healthy and correctly formatted, standardizing diverse security event logs into a controlled vocabulary before alerts are acted upon.

Related Skills

Explore More Software Engineering Skills→
Patasse97Patasse97

threat-detection

Score and prioritize threat hypotheses using MITRE mappings and data-source correlations.

Community
Advanced
patrykkopycinskipatrykkopycinski
6

elastic-workflows

Automate Elastic alerting, ingest pipelines, security detection, and Agent Builder integrations.

Community
Advanced
ivegamsftivegamsft

security-operations

Automate security monitoring, threat detection, and incident response workflows for Kubernetes environments.

Community
Advanced
YukiIto1999YukiIto1999

performing-network-traffic-analysis-with-zeek

Deploy Zeek to collect, parse, and analyze network traffic logs.

Community
Advanced