detection-rule-management

Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

Aller à l'installation Vérifier les fichiers

Dépôt: elastic/example-mcp-app-security
Dernière activité de la source: 17 avril 2026 à 20:40
Langue détectée de SKILL.md: anglais
Étoiles: 25
Forks: 16

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec un assistant IA

Copiez ce prompt dans l’assistant IA que vous utilisez.

Follow https://skillsmp.com/skill-install/prompt.md to install only the Agent Skill at https://github.com/elastic/example-mcp-app-security/tree/main/skills/detection-rule-management.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/elastic/example-mcp-app-security --skill detection-rule-management

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

SKILL.md

Instructions source · Aperçu en lecture seule

name: detection-rule-management
description: Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

# Detection Rule Management Manage detection rules using the `elastic-security` MCP connector. The `manage-rules` tool renders an interactive rule management dashboard. ## Tools (via elastic-security MCP connector) | Tool | Purpose | |------|---------| | `manage-rules` | Browse/search rules with interactive dashboard. Params: `filter` (KQL) | | `threat-hunt` | Test queries against live data before creating rules | The dashboard supports searching rules, viewing details, enabling/disabling, validating queries, and viewing noisy rules. ## Rule Types | Type | Use case | Example | |------|----------|---------| | `query` (KQL) | Simple field matching | `process.name: "mimikatz.exe"` | | `eql` | Behavioral sequences | Process A spawns B within 5 minutes | | `esql` | Analytics/aggregations | Complex joins or transformations | | `threshold` | Count/frequency | >10 failed logins in 5 minutes | | `threat_match` | IOC correlation | Match against malicious IP indicators | | `new_terms` | First-time activity | User logs into host for first time | ## Tuning Strategy (in order of preference) 1. **Add exception** — Known-good process/user/host. Does not modify the rule query. 2. **Tighten the query** — Exclude FP pattern from the rule query itself. 3. **Adjust threshold/suppression** — Increase threshold or enable alert suppression. 4. **Reduce risk score/severity** — Downgrade priority if rule has some value but is noisy. 5. **Disable the rule** — Last resort. Only if rule provides no value. ## Creating New Rules 1. Define the threat (MITRE technique, data sources, malicious vs legitimate behavior) 2. Test the query with `threat-hunt` against live data 3. Create via the dashboard or ask Claude to help construct the rule JSON 4. Monitor alert volume and tune false positives ## Common Index Patterns | Data type | Index pattern | |-----------|--------------| | Alerts | `.alerts-security.alerts-*` | | Processes | `logs-endpoint.events.process-*` | | Network | `logs-endpoint.events.network-*` | | Windows | `logs-windows.*` | | AWS | `logs-aws.*` | | Okta | `logs-okta.*` |

Voir sur GitHub

Retour à la recherche Retour à l’installation

alert-triage

Triage Elastic Security alerts — fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware, lateral movement, credential theft, DLL injection, suspicious processes, or any specific threat. Also trigger for "show me alerts", "what's happening on host X", "any critical alerts", or any security operations question.

2026-04-17

attack-discovery-triage

Triage Elastic Security Attack Discovery findings — fetch correlated attack narratives, assess confidence with entity risk and rule frequency signals, and present an interactive triage dashboard for approval, case creation, and acknowledgment. Use when triaging attack discoveries, reviewing correlated attacks, assessing EASE output, or when the user mentions "attack discovery", "AD findings", "triage attacks", "correlated alerts", or asks to process attack discovery results. Also trigger for "what attacks were discovered", "triage my discoveries", or "any attack discoveries".

2026-04-17

case-management

Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: "show me my cases", "open cases", "list cases", "any open cases", "create a case", "case for this alert", "show me case 42", "incident tracking", "investigation status", or any case-related question.

2026-04-17

Tout voir dans ce dépôt

detection-rule-management

Informations de source

Options d'installation

Installer avec un assistant IA

Vérifiez les fichiers source

Plus depuis ce dépôt

Installer avec un assistant IA

Plus depuis ce dépôt