What it does. Tune SIEM detection rules in Splunk and Elastic to reduce false positives Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-siem-use-case-tuning, or copy the skill folder into ~/.claude/skills/implementing-siem-use-case-tuning/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-use-case-tuning/SKILL.md

SKILL.md (verbatim)

name: implementing-siem-use-case-tuning
description: Tune SIEM detection rules in Splunk and Elastic to reduce false positives
  by analyzing alert volumes, creating context-aware exclusion lists, adjusting
  thresholds against environmental baselines, and measuring precision/recall efficacy
  metrics. Use when a SOC is drowning in noisy alerts and needs to tune correlation
  searches or detection rules, or when measuring and reporting alert-to-incident
  conversion rates.
domain: cybersecurity
subdomain: security-operations
tags:
- siem
- detection-engineering
- false-positive-reduction
- splunk
- elastic
- alert-tuning
- soc
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.CM-01
- RS.MA-01
- GV.OV-01
- DE.AE-02
mitre_attack:
- T1078
- T1190
- T1059
- T1685.002
- T1685.005

Implementing SIEM Use Case Tuning

Overview

SIEM use case tuning reduces alert fatigue by systematically analyzing detection rules for false positive rates, adjusting thresholds based on environmental baselines, creating context-aware whitelists, and measuring detection efficacy through precision/recall metrics. This skill covers tuning workflows for Splunk correlation searches and Elastic detection rules, including statistical baselining, exclusion list management, and alert-to-incident conversion tracking.

When to Use

• When deploying or configuring implementing siem use case tuning capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Splunk Enterprise/Cloud with ES or Elastic SIEM with detection rules enabled
• Historical alert data (minimum 30 days) for baseline analysis
• Python 3.8+ with requests library
• SIEM admin credentials or API tokens

Steps

1. Export current alert volumes per detection rule from SIEM
2. Calculate false positive rate per rule using analyst disposition data
3. Identify top noise-generating rules by volume and FP rate
4. Build environmental baselines for thresholds (e.g., login counts, process spawns)
5. Create whitelist entries for known-good entities (service accounts, scanners)
6. Adjust rule thresholds using statistical analysis (mean + N standard deviations)
7. Measure tuning impact via before/after precision and alert-to-incident ratio

Expected Output

JSON report with per-rule tuning recommendations including current FP rate, suggested threshold adjustments, whitelist entries, and projected alert reduction percentages.

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

SIEM Use Case Tuning API Reference

Splunk Notable Event Export

Export Notables via SPL

| inputlookup notable_events
| search status_label IN ("New", "In Progress", "Resolved")
| table rule_name, _time, status_label, src, dest, user, urgency
| rename status_label as disposition, _time as timestamp
| outputlookup alert_export.csv

Splunk ES Correlation Search Tuning

# Measure FP rate per correlation search over 30 days
| inputlookup notable_events where earliest=-30d
| eval is_fp=if(status_label="Resolved" AND disposition="False Positive", 1, 0)
| stats count as total, sum(is_fp) as fp_count by rule_name
| eval fp_rate=round(fp_count/total, 4)
| sort -fp_rate

Update Correlation Search Threshold

POST /servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches/{search_name}
Content-Type: application/x-www-form-urlencoded

search=<updated_spl_with_new_threshold>

Elastic Detection Rule Tuning

List Detection Rules

GET /_security/detection_engine/rules/_find?per_page=100
Authorization: ApiKey <base64_api_key>

Add Exception to Rule

POST /_security/detection_engine/rules/exceptions
{
  "rule_id": "rule-uuid",
  "name": "Whitelist scanner IPs",
  "entries": [
    {
      "field": "source.ip",
      "operator": "is_one_of",
      "value": ["10.0.1.50", "10.0.1.51"],
      "type": "match_any"
    }
  ]
}

Query Rule Execution Stats (Kibana)

event.kind: "signal" AND kibana.alert.rule.name: "Brute Force Detection"
| stats count by kibana.alert.workflow_status

Alert Tuning Metrics

CLI Usage

# Analyze alert CSV export
python agent.py --alert-csv notable_export.csv --output tuning.json

# Adjust FP threshold for whitelist candidates
python agent.py --alert-csv alerts.csv --fp-threshold 0.9 --top-rules 10

# CSV format: rule_name,timestamp,disposition,source,user,severity

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.