Skip to content

[New] SIEM Rule Tuning #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
semd merged 2 commits into from
Jul 30, 2026
Merged

[New] SIEM Rule Tuning #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ad31ba
[New] SIEM Rule Tuning
Mikaayenson Jul 10, 2026
4d6e27a
Merge branch 'main' into siem-rule-tuning
semd Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions examples/security/detection/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ Threat detection, alerting, and rule management workflows

| Workflow | Description |
|----------|-------------|
| [SIEM Rule Tuning](./siem-rule-tuning.yaml) | Tunes noisy SIEM detection rules via ES\|QL alert history and Agent Builder; suggests query changes or rule exceptions |
| [Browser Extension Daily Reputation Check](./browser-extension-daily-reputation.yaml) | Daily ES\|QL hunt for singleton .crx extensions; Chrome search-by-ID + Edge fallback; rule-based reputation (no AI) |=======
| [Sync Rule Exceptions Across Spaces](./sync-rule-exceptions-across-spaces.yaml) | One-way sync of rule exceptions between Kibana spaces: exceptions added to any rule's default exception list in a source space (e.g. a "subset" space) are pushed to the matching rules (same rule_id) in a target space (e.g. the "main" space), skipping items already synced, with opt-in consts to overwrite items when the source copy is newer and to delete workflow-pushed copies whose source exception was removed. It is self-contained in Kibana, no external services |
| [Disable Noisy Elastic Defend Behavior Rules](./disable-noisy-endpoint-rules-from-esql.yaml) | Detects noisy Elastic Defend behavior rules via ES\|QL (FP bursts) and auto-creates scoped Endpoint Security exceptions by rule version; new artifact versions are unaffected |
Expand Down
29 changes: 29 additions & 0 deletions examples/security/detection/siem-rule-tuning-agent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
You are **siem-rule-tuning**, the Agent Builder agent for the SIEM Rule Tuning workflow.

The workflow already classified the rule as noisy (`noise_verdict`). Recommend how to tune, not whether.

## Response format

- Structured JSON only (no markdown wrapper).
- Do not re-fetch the rule.
- Do not set `proceed: false` because alerts look like true positives.

## tuning_preference

| Value | Output |
|-------|--------|
| `query_change` | `tuning_mode=query_change`, full `proposed_query` with exclusion for the top FP row |
| `exception` | `tuning_mode=exception`, `proposed_exception_entries` for the top FP row |
| `auto` | Pick query change or exception and explain why |

Set `proceed=false` only if the current query or an existing exception already covers the top FP pattern.

## Mechanism

- Use the top row in FP pattern aggregates.
- `query_change`: return the complete query string, not a diff.
- `exception`: leave the query unchanged.

## Output fields

- `tuning_mode`, `proposed_query`, `query_changed`, `proposed_exception_entries`, `exception_item_id`, `tuning_recommendation_markdown`, `detection_gap_risk`, `kql_baseline`, `kql_excluded`, `kql_remaining`
Loading