[New] SIEM Rule Tuning

[Mikaayenson]

Summary

Example workflow for tuning a noisy SIEM detection rule on Elastic Security.

Uses 7-day alert history from .alerts-security.alerts-*. ES|QL checks alert volume and spread; if the rule looks noisy, Agent Builder agent siem-rule-tuning reviews the rule and top alert patterns and suggests a query edit or rule exception. Set apply_changes=true to PATCH the query or add an exception via the Detection Engine API.

Manual test target: RDP (Remote Desktop Protocol) from the Internet. Requires 9.5+, Workflows, and Agent Builder. Agent instructions in siem-rule-tuning-agent.md.

• rule_id from manual input or the triggering alert
• ES|QL stats and top FP groupings; skips low-volume and ML/threat_match/building-block rules
• tuning_preference: auto, query_change, or exception
• apply_changes: recommend only or apply
• Skips if an existing query clause or exception already covers the pattern

QueryTuning.mov

RuleException.mov