From cybersecurity-skills
Reduces SIEM false positives using Splunk SPL for noisy rule identification, threshold tuning, allowlists, and correlation rules to alleviate alert fatigue in SOC operations.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
False positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validat...
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
False positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.
# Splunk - Top 10 noisiest correlation searches
index=notable
| stats count by rule_name
| sort -count
| head 10
| eval pct=round(count / total * 100, 1)
# False positive rate per rule
index=notable
| stats count as total
count(eval(status_label="Closed - False Positive")) as false_positives
count(eval(status_label="Closed - True Positive")) as true_positives
by rule_name
| eval fp_rate=round(false_positives / total * 100, 1)
| sort -fp_rate
| where total > 10
# Before: Too sensitive - fires on 5 failed logins
index=wineventlog EventCode=4625
| stats count by src_ip
| where count > 5
# After: Tuned - requires 20+ failures across 3+ accounts in 10 minutes
index=wineventlog EventCode=4625
| bin _time span=10m
| stats count dc(TargetUserName) as unique_accounts by src_ip, _time
| where count > 20 AND unique_accounts > 3
# Create allowlist lookup for known benign sources
| inputlookup fp_allowlist.csv
| fields src_ip, reason, approved_by, expiry_date
# Apply allowlist in detection rule
index=wineventlog EventCode=4625
| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason
| where isnull(allowlisted_reason)
| stats count dc(TargetUserName) as unique_accounts by src_ip
| where count > 20 AND unique_accounts > 3
# Before: Single-event detection (noisy)
index=wineventlog EventCode=4688 New_Process_Name="*powershell.exe"
| eval severity="medium"
# After: Multi-signal correlation (precise)
index=wineventlog EventCode=4688 New_Process_Name="*powershell.exe"
| join src_ip type=left [
search index=wineventlog EventCode=4625
| stats count as failed_logins by src_ip
]
| join Computer type=left [
search index=sysmon EventCode=3
| stats dc(DestinationIp) as unique_external_connections by Computer
| where unique_external_connections > 10
]
| where isnotnull(failed_logins) OR unique_external_connections > 10
| eval severity=case(
failed_logins > 10 AND unique_external_connections > 10, "critical",
failed_logins > 5 OR unique_external_connections > 5, "high",
true(), "medium"
)
# Exclude known maintenance windows
| eval hour=strftime(_time, "%H")
| eval day=strftime(_time, "%A")
| where NOT (hour >= "02" AND hour <= "04" AND day="Sunday")
# Exclude known batch job schedules
| lookup scheduled_tasks_allowlist process_name, schedule_time
OUTPUT is_scheduled
| where isnull(is_scheduled)
# Build baseline for user login patterns
index=wineventlog EventCode=4624
| bin _time span=1h
| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time
| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins
avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts
by TargetUserName
| where logins > (avg_logins + 3 * stdev_logins)
OR unique_hosts > (avg_hosts + 3 * stdev_hosts)
# Only alert when destination matches known threat intelligence
index=firewall action=allowed direction=outbound
| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence
| where isnotnull(threat_type) AND confidence > 70
# This eliminates FPs from flagging connections to benign IPs
# Run Atomic Red Team test after tuning to confirm detection still works
# Example: Test brute force detection after threshold adjustment
Invoke-AtomicTest T1110.001 -TestNumbers 1
# Verify detection still triggers after tuning
index=notable rule_name="Brute Force Detection"
earliest=-24h
| stats count
| where count > 0
| Metric | Formula | Target |
|---|---|---|
| False Positive Rate | FP / (FP + TP) * 100 | < 20% |
| Alert Volume Reduction | (Old Volume - New Volume) / Old Volume * 100 | 30-50% per quarter |
| Mean Triage Time | Total triage time / Total alerts | < 8 minutes |
| Rule Precision | TP / (TP + FP) | > 0.80 |
| Analyst Satisfaction | Survey score | > 4/5 |