detection-rule-management
Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".
소스 정보
- 저장소
- elastic/example-mcp-app-security
- 최근 소스 활동
- 2026년 4월 17일 20:40
- 감지된 SKILL.md 언어
- 영어
- 스타
- 25
- 포크
- 16
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- detection-rule-management
- description
- Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".
# Detection Rule Management
Manage detection rules using the `elastic-security` MCP connector. The `manage-rules` tool renders an interactive
rule management dashboard.
## Tools (via elastic-security MCP connector)
| Tool | Purpose |
|------|---------|
| `manage-rules` | Browse/search rules with interactive dashboard. Params: `filter` (KQL) |
| `threat-hunt` | Test queries against live data before creating rules |
The dashboard supports searching rules, viewing details, enabling/disabling, validating queries, and viewing noisy rules.
## Rule Types
| Type | Use case | Example |
|------|----------|---------|
| `query` (KQL) | Simple field matching | `process.name: "mimikatz.exe"` |
| `eql` | Behavioral sequences | Process A spawns B within 5 minutes |
| `esql` | Analytics/aggregations | Complex joins or transformations |
| `threshold` | Count/frequency | >10 failed logins in 5 minutes |
| `threat_match` | IOC correlation | Match against malicious IP indicators |
| `new_terms` | First-time activity | User logs into host for first time |
## Tuning Strategy (in order of preference)
1. **Add exception** — Known-good process/user/host. Does not modify the rule query.
2. **Tighten the query** — Exclude FP pattern from the rule query itself.
3. **Adjust threshold/suppression** — Increase threshold or enable alert suppression.
4. **Reduce risk score/severity** — Downgrade priority if rule has some value but is noisy.
5. **Disable the rule** — Last resort. Only if rule provides no value.
## Creating New Rules
1. Define the threat (MITRE technique, data sources, malicious vs legitimate behavior)
2. Test the query with `threat-hunt` against live data
3. Create via the dashboard or ask Claude to help construct the rule JSON
4. Monitor alert volume and tune false positives
## Common Index Patterns
| Data type | Index pattern |
|-----------|--------------|
| Alerts | `.alerts-security.alerts-*` |
| Processes | `logs-endpoint.events.process-*` |
| Network | `logs-endpoint.events.network-*` |
| Windows | `logs-windows.*` |
| AWS | `logs-aws.*` |
| Okta | `logs-okta.*` |
GitHub에서 보기