implementing-siem-use-cases-for-detection

name	implementing-siem-use-cases-for-detection
description	Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","siem","use-cases","detection-engineering","mitre-attack","splunk","elastic","sentinel"]
version	1.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
d3fend_techniques	["Token Binding","Restore Access","Password Authentication","Reissue Credential","Strong Password Policy"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]
mitre_attack	["T1078","T1685.002","T1685.005","T1566","T0816"]

Implementing SIEM Use Cases for Detection

When to Use

Use this skill when:

• SOC teams need to build or expand their SIEM detection library from scratch
• Threat assessments identify ATT&CK technique gaps requiring new detection rules
• Detection engineers need a structured process for use case design, testing, and deployment
• Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX)

Do not use for ad-hoc hunting queries — use cases are formalized, tested, and maintained detection rules, not exploratory searches.

Prerequisites

• SIEM platform (Splunk ES, Elastic Security, or Microsoft Sentinel) with production data
• ATT&CK Navigator for coverage gap analysis
• Log sources normalized to CIM/ECS field standards
• Use case documentation framework (wiki, Git repo, or detection engineering platform)
• Testing environment with attack simulation tools (Atomic Red Team, MITRE Caldera)

Workflow

Step 1: Assess Detection Coverage Gaps

Map current detection rules to ATT&CK and identify gaps:

import json

# Load current detection rules mapped to ATT&CK
current_rules = [
    {"name": "Brute Force Detection", "techniques": ["T1110.001", "T1110.003"]},
    {"name": "Malware Hash Match", "techniques": ["T1204.002"]},
    {"name": "Suspicious PowerShell", "techniques": ["T1059.001"]},
]

# Load ATT&CK Enterprise techniques
with open("enterprise-attack.json") as f:
    attack = json.load(f)

all_techniques = set()
for obj in attack["objects"]:
    if obj["type"] == "attack-pattern":
        ext = obj.get(, [])
         ref  ext:
             ref.get() == :
                all_techniques.add(ref[])

covered = ()
 rule  current_rules:
    covered.update(rule[])

gaps = all_techniques - covered
()
()
()


priority_techniques = [
    , , , , ,
    , , , , 
]
priority_gaps = [t  t  priority_techniques  t  gaps]
()