Reduces SIEM false positives using Splunk SPL for rule tuning, threshold adjustments, whitelisting, correlations, and time exclusions. For SOC alert fatigue.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
误报（False Positive）告警是触发安全规则的非恶意事件，会用噪音淹没 SOC 分析师。研究显示，高达 45% 的 SIEM 告警是误报，而一名典型的 SOC 分析师每班只能有效调查 20-25 条告警。减少误报需要跨越阈值、关联逻辑、白名单、丰富化和持续验证进行系统性调优。SIEM 规则至少应按季度周期进行审查。
Reduces SIEM false positives using Splunk SPL for noisy rule identification, threshold tuning, allowlists, and correlation rules to alleviate alert fatigue in SOC operations.
Performs SIEM false positive reduction via rule tuning, threshold adjustment, allowlists, correlation refinement, and Splunk SPL queries to combat SOC alert fatigue.
Tunes SIEM detection rules in Splunk and Elastic by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring precision/recall to reduce false positives.
Share bugs, ideas, or general feedback.
误报（False Positive）告警是触发安全规则的非恶意事件，会用噪音淹没 SOC 分析师。研究显示，高达 45% 的 SIEM 告警是误报，而一名典型的 SOC 分析师每班只能有效调查 20-25 条告警。减少误报需要跨越阈值、关联逻辑、白名单、丰富化和持续验证进行系统性调优。SIEM 规则至少应按季度周期进行审查。
# Splunk - 前 10 个最嘈杂的关联搜索
index=notable
| stats count by rule_name
| sort -count
| head 10
| eval pct=round(count / total * 100, 1)
# 每条规则的误报率
index=notable
| stats count as total
count(eval(status_label="Closed - False Positive")) as false_positives
count(eval(status_label="Closed - True Positive")) as true_positives
by rule_name
| eval fp_rate=round(false_positives / total * 100, 1)
| sort -fp_rate
| where total > 10
# 调优前：过于敏感——5 次登录失败即触发
index=wineventlog EventCode=4625
| stats count by src_ip
| where count > 5
# 调优后：经过调优——需要 10 分钟内 20+ 次失败且涉及 3+ 个账号
index=wineventlog EventCode=4625
| bin _time span=10m
| stats count dc(TargetUserName) as unique_accounts by src_ip, _time
| where count > 20 AND unique_accounts > 3
# 为已知良性来源创建白名单查找表
| inputlookup fp_allowlist.csv
| fields src_ip, reason, approved_by, expiry_date
# 在检测规则中应用白名单
index=wineventlog EventCode=4625
| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason
| where isnull(allowlisted_reason)
| stats count dc(TargetUserName) as unique_accounts by src_ip
| where count > 20 AND unique_accounts > 3
# 调优前：单事件检测（嘈杂）
index=wineventlog EventCode=4688 New_Process_Name="*powershell.exe"
| eval severity="medium"
# 调优后：多信号关联（精确）
index=wineventlog EventCode=4688 New_Process_Name="*powershell.exe"
| join src_ip type=left [
search index=wineventlog EventCode=4625
| stats count as failed_logins by src_ip
]
| join Computer type=left [
search index=sysmon EventCode=3
| stats dc(DestinationIp) as unique_external_connections by Computer
| where unique_external_connections > 10
]
| where isnotnull(failed_logins) OR unique_external_connections > 10
| eval severity=case(
failed_logins > 10 AND unique_external_connections > 10, "critical",
failed_logins > 5 OR unique_external_connections > 5, "high",
true(), "medium"
)
# 排除已知维护窗口
| eval hour=strftime(_time, "%H")
| eval day=strftime(_time, "%A")
| where NOT (hour >= "02" AND hour <= "04" AND day="Sunday")
# 排除已知批处理任务计划
| lookup scheduled_tasks_allowlist process_name, schedule_time
OUTPUT is_scheduled
| where isnull(is_scheduled)
# 构建用户登录模式基线
index=wineventlog EventCode=4624
| bin _time span=1h
| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time
| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins
avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts
by TargetUserName
| where logins > (avg_logins + 3 * stdev_logins)
OR unique_hosts > (avg_hosts + 3 * stdev_hosts)
# 仅在目标匹配已知威胁情报时告警
index=firewall action=allowed direction=outbound
| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence
| where isnotnull(threat_type) AND confidence > 70
# 这消除了将连接到良性 IP 标记为误报的情况
# 调优后运行 Atomic Red Team 测试以确认检测仍然有效
# 示例：阈值调整后测试暴力破解检测
Invoke-AtomicTest T1110.001 -TestNumbers 1
# 验证调优后检测仍然触发
index=notable rule_name="Brute Force Detection"
earliest=-24h
| stats count
| where count > 0
| 指标 | 公式 | 目标 |
|---|---|---|
| 误报率（False Positive Rate） | FP / (FP + TP) * 100 | < 20% |
| 告警量减少 | (旧量 - 新量) / 旧量 * 100 | 每季度 30-50% |
| 平均分诊时间 | 总分诊时间 / 总告警数 | < 8 分钟 |
| 规则精确率（Rule Precision） | TP / (TP + FP) | > 0.80 |
| 分析师满意度 | 调查评分 | > 4/5 |