detection-tuning

Detection Tuning Skill

Analyze and tune CrowdStrike NGSIEM detection rules for actionable security alerting with minimal false positives.

Purpose

Transform raw out-of-the-box (OOTB) detection templates into production-ready rules by:

1. Applying environmental context (user population, infrastructure, baseline patterns)
2. Integrating available CQL enrichment functions for identity classification
3. Recommending threshold and exclusion tuning based on false positive patterns
4. Generating analyst-ready YAML templates

Analysis Workflow

Step 1: Read the Detection Template

# Read the target detection
cat resources/detections/<vendor>/<detection_file>.yaml

Extract and understand:

• Vendor/Data Source: AWS CloudTrail, EntraID, SASE, Google, CrowdStrike, GitHub
• Detection Logic: What events trigger alerts
• Current Thresholds: Count thresholds, time windows
• Existing Exclusions: Any commented or active filters

Step 2: Identify Tuning Opportunities

Reference ENVIRONMENT_CONTEXT.md to understand:

• User Population: ~500 users, primarily US-based across all timezones
• High-Risk Users: Executives and engineers (Mac users with elevated access)
• Infrastructure: 100% cloud (11 AWS accounts, EntraID, Google Workspace, GitHub)
• Normal Patterns: Business hours activity, SASE VPN connections, SSO logins
• GitHub Activity: Service account patterns (merge-queue, dependabot, Actions automation)
• Statistical Baselines: For 500-user environment, consider 30-60 day baselines for establishing normal behavior
• Privilege Context: TEAM users (PAM system), global admins, engineering groups with elevated access

Step 2.5: Pre-Activation Historical Query (when activating an inactive or new detection)

Run this step before setting status: active on any detection. Skip only for detections targeting rare/clearly malicious TTPs (credential dumping, crypto miners) where expected volume is near-zero, or for log sources with fewer than 7 days of history.