Skip to content

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Feb 5, 2025

Issues

Resolves #4424

Summary

Excluding noisy patterns

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Feb 5, 2025
@w0rk3r w0rk3r self-assigned this Feb 5, 2025
Copy link
Contributor

github-actions bot commented Feb 5, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.
@w0rk3r w0rk3r merged commit 3e0ba33 into main Feb 5, 2025
9 checks passed
@w0rk3r w0rk3r deleted the crwd_exe_rt branch February 5, 2025 17:51
r0ot added a commit to VigilantSec/detection-rules that referenced this pull request Feb 5, 2025
* [Rule Tuning] Port Scan Rules (elastic#4443) * [New Hunt] General Kernel Manipulation (elastic#4403) * [New Hunt] General Kernel Manipulation * Update index.yml * [New Hunt] Persistence via PolicyKit (elastic#4406) * [New Hunt] Persistence via PolicyKit * ++ * [New Hunt] Persistence via Desktop Bus (D-Bus) (elastic#4407) * [Rule Tuning] Remote Execution via File Shares (elastic#4448) * [Rule Tuning] Tighten Up Elastic Defend Indexes - MacOS (elastic#4447) * tags (#4) Co-authored-by: peterydzynski <peter.rydzynski1@gmail.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: peterydzynski <peter.rydzynski1@gmail.com>
@r0ot r0ot mentioned this pull request Feb 5, 2025
5 tasks
r0ot added a commit to VigilantSec/detection-rules that referenced this pull request Feb 5, 2025
* [Rule Tuning] Port Scan Rules (elastic#4443) * [New Hunt] General Kernel Manipulation (elastic#4403) * [New Hunt] General Kernel Manipulation * Update index.yml * [New Hunt] Persistence via PolicyKit (elastic#4406) * [New Hunt] Persistence via PolicyKit * ++ * [New Hunt] Persistence via Desktop Bus (D-Bus) (elastic#4407) * [Rule Tuning] Remote Execution via File Shares (elastic#4448) * [Rule Tuning] Tighten Up Elastic Defend Indexes - MacOS (elastic#4447) * tags (#4) --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: peterydzynski <peter.rydzynski1@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport: auto community Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

3 participants