skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-siem-use-cases-for-detection

Implements SIEM detection use cases with correlation rules mapped to MITRE ATT&CK techniques.

954|172|Updated Mar 13, 2026
Search Tags:#sentinel#siem#splunk#SoC#mitre att&ck#detection engineering#correlation rules
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-siem-use-cases-for-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-siem-use-cases-for-detection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/implementing-siem-use-cases-for-detection
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-siem-use-cases-for-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC teams often lack a structured process for building, testing, and maintaining SIEM detection rules, resulting in ATT&CK coverage gaps, untested alerts, and high false positive rates.

Core Features & Use Cases

  • Coverage Gap Analysis: Map existing detection rules against MITRE ATT&CK techniques to identify and prioritize detection gaps.
  • Cross-Platform Detection Logic: Implement the same use case as Splunk SPL correlation searches, Elastic EQL rules, and Microsoft Sentinel KQL queries.
  • Lifecycle Management: Move use cases through proposed, development, testing, staging, production, review, and deprecated states with Atomic Red Team validation.
  • Use Case: After a red team exercise reveals LSASS credential dumping went undetected, design a T1003.001 use case, test it with Atomic Red Team, tune out CrowdStrike false positives, and deploy it to production.

Quick Start

Ask the AI to design and test a SIEM detection use case for LSASS credential dumping across Splunk and Sentinel.

Frequently Asked Questions about implementing-siem-use-cases-for-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build SIEM detection use cases mapped to MITRE ATT&CK?▼

Start by mapping existing rules to ATT&CK techniques to find coverage gaps, then document each new use case with a standardized template covering log sources, severity, and false positive sources. Write the detection logic, validate it with Atomic Red Team, and deploy through a staged lifecycle.

How to write the same detection rule for Splunk, Elastic, and Sentinel?▼

Write platform-specific queries from one use case specification: SPL correlation searches or tstats for Splunk ES, EQL for Elastic Security, and KQL for Microsoft Sentinel. Keep the detection logic, exclusions, and ATT&CK mapping consistent across all three implementations.

How do I test SIEM detection rules before production deployment?▼

Use Atomic Red Team to execute the relevant ATT&CK technique tests, such as Invoke-AtomicTest T1003.001 for credential dumping, then verify alerts fire in the SIEM. Run a 7-day backtest to measure false positive rates before promoting the rule to production.

What false positive rate is acceptable for SIEM detection rules?▼

The target false positive rate for production use cases is under 20 percent, with detection latency under 5 minutes for critical detections. Maintain exclusion lists for known benign tools like antivirus and EDR sensors, and review them quarterly.

When should I not use formalized SIEM use cases?▼

Do not use formalized use cases for ad-hoc threat hunting queries, which are exploratory searches rather than tested, maintained detection rules. Use cases are appropriate when you need documented, validated, and lifecycle-managed detection aligned to compliance or threat requirements.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
starwreckntxstarwreckntx

Security Orchestration Agent

Automate security playbooks and incident-response workflows across security swarm agents.

Community
Basic
AxxxxxxaaannAxxxxxxaaann

analyzing-apt-group-with-mitre-navigator

Map MITRE ATT&CK techniques of an APT group to Navigator layers.

Community
Advanced
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic