[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFDD01SXSQMEA77HAABEWZ":3,"skill-same:01M6AFDD01SXSQMEA77HAABEWZ":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":80,"commitSha":81,"skillDirectory":82,"forksCount":83,"repositoryHtmlUrl":84,"repositoryHomepageUrl":85,"ownerHtmlUrl":86,"ownerBlogUrl":87,"ownerDescription":88,"updatedAt":89,"install":90,"resources":103},"01M6AFDD01SXSQMEA77HAABEWZ","implementing-siem-use-cases-for-detection",null,"Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing siem use cases for detection","siem","detection","detection-engineering","lifecycle","t1566","t1078","ATT&CK","correlation","sentinel","elastic","policy","splunk","soc","mitre-attack","library","authentication","teams","analytics","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-siem-use-cases-for-detection\ndescription: 'Implements SIEM detection use cases by designing correlation rules,\n  threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across\n  Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage,\n  formalize use case lifecycle management, or build a detection library aligned to\n  organizational threat profile.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- siem\n- use-cases\n- detection-engineering\n- mitre-attack\n- splunk\n- elastic\n- sentinel\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nd3fend_techniques:\n- Token Binding\n- Restore Access\n- Password Authentication\n- Reissue Credential\n- Strong Password Policy\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n- T0816\n---\n# Implementing SIEM Use Cases for Detection\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to build or expand their SIEM detection library from scratch\n- Threat assessments identify ATT&CK technique gaps requiring new detection rules\n- Detection engineers need a structured process for use case design, testing, and deployment\n- Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX)\n\n**Do not use** for ad-hoc hunting queries — use cases are formalized, tested, and maintained detection rules, not exploratory searches.\n\n## Prerequisites\n\n- SIEM platform (Splunk ES, Elastic Security, or Microsoft Sentinel) with production data\n- ATT&CK Navigator for coverage gap analysis\n- Log sources normalized to CIM\u002FECS field standards\n- Use case documentation framework (wiki, Git repo, or detection engineering platform)\n- Testing environment with attack simulation tools (Atomic Red Team, MITRE Caldera)\n\n## Workflow\n\n### Step 1: Assess Detection Coverage Gaps\n\nMap current detection rules to ATT&CK and identify gaps:\n\n```python\nimport json\n\n# Load current detection rules mapped to ATT&CK\ncurrent_rules = [\n    {\"name\": \"Brute Force Detection\", \"techniques\": [\"T1110.001\", \"T1110.003\"]},\n    {\"name\": \"Malware Hash Match\", \"techniques\": [\"T1204.002\"]},\n    {\"name\": \"Suspicious PowerShell\", \"techniques\": [\"T1059.001\"]},\n]\n\n# Load ATT&CK Enterprise techniques\nwith open(\"enterprise-attack.json\") as f:\n    attack = json.load(f)\n\nall_techniques = set()\nfor obj in attack[\"objects\"]:\n    if obj[\"type\"] == \"attack-pattern\":\n        ext = obj.get(\"external_references\", [])\n        for ref in ext:\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                all_techniques.add(ref[\"external_id\"])\n\ncovered = set()\nfor rule in current_rules:\n    covered.update(rule[\"techniques\"])\n\ngaps = all_techniques - covered\nprint(f\"Total techniques: {len(all_techniques)}\")\nprint(f\"Covered: {len(covered)} ({len(covered)\u002Flen(all_techniques)*100:.1f}%)\")\nprint(f\"Gaps: {len(gaps)}\")\n\n# Prioritize gaps by threat relevance\npriority_techniques = [\n    \"T1003\", \"T1021\", \"T1053\", \"T1547\", \"T1078\",\n    \"T1055\", \"T1071\", \"T1105\", \"T1036\", \"T1070\"\n]\npriority_gaps = [t for t in priority_techniques if t in gaps]\nprint(f\"Priority gaps: {priority_gaps}\")\n```\n\n### Step 2: Design Use Case Specification\n\nDocument each use case with a standardized template:\n\n```yaml\nuse_case_id: UC-2024-015\nname: Credential Dumping via LSASS Access\ndescription: Detects tools accessing LSASS process memory for credential extraction\nmitre_attack:\n  tactic: Credential Access (TA0006)\n  technique: T1003.001 - LSASS Memory\n  data_sources:\n    - Process: OS API Execution (Sysmon EventCode 10)\n    - Process: Process Access (Windows Security 4663)\nlog_sources:\n  - index: sysmon, sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\n  - index: wineventlog, sourcetype: WinEventLog:Security\nseverity: High\nconfidence: Medium-High\nfalse_positive_sources:\n  - Antivirus products scanning LSASS\n  - CrowdStrike Falcon sensor\n  - Windows Defender ATP\n  - SCCM client\ntuning_notes: >\n  Maintain exclusion list for known security tools that legitimately access LSASS.\n  Review exclusions quarterly for newly deployed security products.\nsla: Alert within 5 minutes of detection\nowner: detection_engineering_team\nstatus: Production\ncreated: 2024-03-15\nlast_tested: 2024-03-15\n```\n\n### Step 3: Implement Detection Logic Across Platforms\n\n**Splunk ES Correlation Search:**\n```spl\n| tstats summariesonly=true count from datamodel=Endpoint.Processes\n  where Processes.process_name=\"lsass.exe\"\n  by Processes.dest, Processes.user, Processes.process_name,\n     Processes.parent_process_name, Processes.parent_process\n| `drop_dm_object_name(Processes)`\n| lookup lsass_access_whitelist parent_process AS parent_process OUTPUT is_whitelisted\n| where isnull(is_whitelisted) OR is_whitelisted!=\"true\"\n| `credential_dumping_lsass_filter`\n```\n\nOr using raw Sysmon data:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\nNOT [| inputlookup lsass_whitelist.csv | fields SourceImage]\n| stats count, values(GrantedAccess) AS access_flags by Computer, SourceImage, SourceUser\n| where count > 0\n```\n\n**Elastic Security EQL Rule:**\n```eql\nprocess where event.type == \"access\" and\n  process.name == \"lsass.exe\" and\n  not process.executable : (\n    \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n    \"?:\\\\Windows\\\\System32\\\\csrss.exe\",\n    \"?:\\\\Program Files\\\\CrowdStrike\\\\*\",\n    \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*\"\n  )\n```\n\n**Microsoft Sentinel KQL Rule:**\n```kql\nDeviceProcessEvents\n| where Timestamp > ago(1h)\n| where FileName == \"lsass.exe\"\n| where ActionType == \"ProcessAccessed\"\n| where InitiatingProcessFileName !in (\"svchost.exe\", \"csrss.exe\", \"MsMpEng.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName,\n          InitiatingProcessCommandLine, AccountName\n```\n\n### Step 4: Test with Attack Simulation\n\nValidate detection rules using Atomic Red Team:\n\n```bash\n# Install Atomic Red Team\nIEX (IWR 'https:\u002F\u002Fraw.githubusercontent.com\u002Fredcanaryco\u002Finvoke-atomicredteam\u002Fmaster\u002Finstall-atomicredteam.ps1' -UseBasicParsing)\nInstall-AtomicRedTeam -getAtomics\n\n# Execute T1003.001 - Credential Dumping\nInvoke-AtomicTest T1003.001 -TestNumbers 1,2,3\n\n# Execute T1053.005 - Scheduled Task\nInvoke-AtomicTest T1053.005 -TestNumbers 1\n\n# Execute T1547.001 - Registry Run Key\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2\n```\n\nVerify detection in SIEM:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nearliest=-1h\n| stats count by Computer, SourceImage, GrantedAccess\n| where count > 0\n```\n\nDocument test results:\n```\nTEST RESULTS — UC-2024-015\nAtomic Test T1003.001-1 (Mimikatz):      DETECTED (alert fired in 47s)\nAtomic Test T1003.001-2 (ProcDump):      DETECTED (alert fired in 32s)\nAtomic Test T1003.001-3 (Task Manager):  FALSE NEGATIVE (excluded by whitelist — expected)\nFalse Positive Rate (7-day backtest):     2 events (CrowdStrike scan — added to whitelist)\n```\n\n### Step 5: Deploy and Monitor Use Case Health\n\nTrack detection rule effectiveness:\n\n```spl\n-- Use case firing frequency\nindex=notable\n| stats count AS fires, dc(src) AS unique_sources,\n        dc(dest) AS unique_dests\n  by rule_name, status_label\n| eval true_positive_rate = round(\n    sum(eval(if(status_label=\"Resolved - True Positive\", 1, 0))) \u002F\n    count * 100, 1)\n| sort - fires\n| table rule_name, fires, unique_sources, unique_dests, true_positive_rate\n\n-- Detection latency monitoring\nindex=notable\n| eval detection_latency = _time - orig_time\n| stats avg(detection_latency) AS avg_latency_sec,\n        perc95(detection_latency) AS p95_latency_sec\n  by rule_name\n| eval avg_latency_min = round(avg_latency_sec \u002F 60, 1)\n| sort - avg_latency_sec\n```\n\n### Step 6: Maintain Use Case Library\n\nEstablish lifecycle management for all detection use cases:\n\n```\nUSE CASE LIFECYCLE\n━━━━━━━━━━━━━━━━━━\n1. PROPOSED    → New detection need identified (threat intel, gap analysis, incident finding)\n2. DEVELOPMENT → Query written, false positive analysis, tuning\n3. TESTING     → Atomic Red Team validation, 7-day backtest\n4. STAGING     → Deployed in alert-only mode (no incident creation) for 14 days\n5. PRODUCTION  → Full production with incident creation and SOAR integration\n6. REVIEW      → Quarterly review of effectiveness, false positive rate, relevance\n7. DEPRECATED  → Technique no longer relevant or replaced by better detection\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Use Case** | Formalized detection rule with documented logic, testing, tuning, and lifecycle management |\n| **Detection Engineering** | Practice of designing, testing, and maintaining SIEM detection rules as a software development discipline |\n| **Correlation Search** | SIEM query that combines events from multiple sources to identify attack patterns |\n| **False Positive Rate** | Percentage of alerts that are benign activity — target \u003C20% for production use cases |\n| **Detection Latency** | Time between event occurrence and alert generation — target \u003C5 minutes for critical detections |\n| **ATT&CK Coverage** | Percentage of relevant ATT&CK techniques with at least one production detection rule |\n\n## Tools & Systems\n\n- **Splunk ES**: Enterprise SIEM with correlation searches, risk-based alerting, and Incident Review\n- **Elastic Security**: SIEM with detection rules, EQL sequences, and ML-based anomaly detection\n- **Microsoft Sentinel**: Cloud SIEM with KQL analytics rules, Fusion ML engine, and Lighthouse multi-tenant\n- **Atomic Red Team**: Open-source attack simulation framework for testing detection rules against ATT&CK techniques\n- **ATT&CK Navigator**: MITRE visualization tool for mapping and tracking detection coverage across techniques\n\n## Common Scenarios\n\n- **Post-Incident Use Case**: After a ransomware incident, build detection for the initial access vector discovered during investigation\n- **Compliance-Driven**: PCI DSS requires detection of admin account misuse — build use cases for 4672\u002F4720\u002F4732 events\n- **Threat-Intel Driven**: New APT group targets your sector — build use cases for their documented TTPs\n- **Red Team Findings**: Purple team exercise identifies blind spots — convert findings into production detection rules\n- **SIEM Migration**: Migrating from QRadar to Splunk — convert and validate all existing use cases on new platform\n\n## Output Format\n\n```\nUSE CASE DEPLOYMENT REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━\nQuarter:      Q1 2024\nTotal Use Cases: 147 (Production: 128, Staging: 12, Development: 7)\n\nNew Deployments This Quarter:\n  UC-2024-012  Kerberoasting Detection (T1558.003)     — Production\n  UC-2024-013  DLL Side-Loading (T1574.002)            — Production\n  UC-2024-014  Scheduled Task Persistence (T1053.005)  — Production\n  UC-2024-015  LSASS Memory Access (T1003.001)         — Staging\n\nATT&CK Coverage:\n  Overall: 67% of relevant techniques (up from 61%)\n  Initial Access:      78%\n  Execution:           82%\n  Persistence:         71%\n  Credential Access:   65%\n  Lateral Movement:    58% (priority gap area)\n\nHealth Metrics:\n  Avg True Positive Rate:    74% (target: >70%)\n  Avg Detection Latency:     2.3 min (target: \u003C5 min)\n  Use Cases Deprecated:      3 (replaced by improved versions)\n```\n","# Implementing SIEM Use Cases for Detection\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to build or expand their SIEM detection library from scratch\n- Threat assessments identify ATT&CK technique gaps requiring new detection rules\n- Detection engineers need a structured process for use case design, testing, and deployment\n- Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX)\n\n**Do not use** for ad-hoc hunting queries — use cases are formalized, tested, and maintained detection rules, not exploratory searches.\n\n## Prerequisites\n\n- SIEM platform (Splunk ES, Elastic Security, or Microsoft Sentinel) with production data\n- ATT&CK Navigator for coverage gap analysis\n- Log sources normalized to CIM\u002FECS field standards\n- Use case documentation framework (wiki, Git repo, or detection engineering platform)\n- Testing environment with attack simulation tools (Atomic Red Team, MITRE Caldera)\n\n## Workflow\n\n### Step 1: Assess Detection Coverage Gaps\n\nMap current detection rules to ATT&CK and identify gaps:\n\n```python\nimport json\n\n# Load current detection rules mapped to ATT&CK\ncurrent_rules = [\n    {\"name\": \"Brute Force Detection\", \"techniques\": [\"T1110.001\", \"T1110.003\"]},\n    {\"name\": \"Malware Hash Match\", \"techniques\": [\"T1204.002\"]},\n    {\"name\": \"Suspicious PowerShell\", \"techniques\": [\"T1059.001\"]},\n]\n\n# Load ATT&CK Enterprise techniques\nwith open(\"enterprise-attack.json\") as f:\n    attack = json.load(f)\n\nall_techniques = set()\nfor obj in attack[\"objects\"]:\n    if obj[\"type\"] == \"attack-pattern\":\n        ext = obj.get(\"external_references\", [])\n        for ref in ext:\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                all_techniques.add(ref[\"external_id\"])\n\ncovered = set()\nfor rule in current_rules:\n    covered.update(rule[\"techniques\"])\n\ngaps = all_techniques - covered\nprint(f\"Total techniques: {len(all_techniques)}\")\nprint(f\"Covered: {len(covered)} ({len(covered)\u002Flen(all_techniques)*100:.1f}%)\")\nprint(f\"Gaps: {len(gaps)}\")\n\n# Prioritize gaps by threat relevance\npriority_techniques = [\n    \"T1003\", \"T1021\", \"T1053\", \"T1547\", \"T1078\",\n    \"T1055\", \"T1071\", \"T1105\", \"T1036\", \"T1070\"\n]\npriority_gaps = [t for t in priority_techniques if t in gaps]\nprint(f\"Priority gaps: {priority_gaps}\")\n```\n\n### Step 2: Design Use Case Specification\n\nDocument each use case with a standardized template:\n\n```yaml\nuse_case_id: UC-2024-015\nname: Credential Dumping via LSASS Access\ndescription: Detects tools accessing LSASS process memory for credential extraction\nmitre_attack:\n  tactic: Credential Access (TA0006)\n  technique: T1003.001 - LSASS Memory\n  data_sources:\n    - Process: OS API Execution (Sysmon EventCode 10)\n    - Process: Process Access (Windows Security 4663)\nlog_sources:\n  - index: sysmon, sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\n  - index: wineventlog, sourcetype: WinEventLog:Security\nseverity: High\nconfidence: Medium-High\nfalse_positive_sources:\n  - Antivirus products scanning LSASS\n  - CrowdStrike Falcon sensor\n  - Windows Defender ATP\n  - SCCM client\ntuning_notes: >\n  Maintain exclusion list for known security tools that legitimately access LSASS.\n  Review exclusions quarterly for newly deployed security products.\nsla: Alert within 5 minutes of detection\nowner: detection_engineering_team\nstatus: Production\ncreated: 2024-03-15\nlast_tested: 2024-03-15\n```\n\n### Step 3: Implement Detection Logic Across Platforms\n\n**Splunk ES Correlation Search:**\n```spl\n| tstats summariesonly=true count from datamodel=Endpoint.Processes\n  where Processes.process_name=\"lsass.exe\"\n  by Processes.dest, Processes.user, Processes.process_name,\n     Processes.parent_process_name, Processes.parent_process\n| `drop_dm_object_name(Processes)`\n| lookup lsass_access_whitelist parent_process AS parent_process OUTPUT is_whitelisted\n| where isnull(is_whitelisted) OR is_whitelisted!=\"true\"\n| `credential_dumping_lsass_filter`\n```\n\nOr using raw Sysmon data:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\nNOT [| inputlookup lsass_whitelist.csv | fields SourceImage]\n| stats count, values(GrantedAccess) AS access_flags by Computer, SourceImage, SourceUser\n| where count > 0\n```\n\n**Elastic Security EQL Rule:**\n```eql\nprocess where event.type == \"access\" and\n  process.name == \"lsass.exe\" and\n  not process.executable : (\n    \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n    \"?:\\\\Windows\\\\System32\\\\csrss.exe\",\n    \"?:\\\\Program Files\\\\CrowdStrike\\\\*\",\n    \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*\"\n  )\n```\n\n**Microsoft Sentinel KQL Rule:**\n```kql\nDeviceProcessEvents\n| where Timestamp > ago(1h)\n| where FileName == \"lsass.exe\"\n| where ActionType == \"ProcessAccessed\"\n| where InitiatingProcessFileName !in (\"svchost.exe\", \"csrss.exe\", \"MsMpEng.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName,\n          InitiatingProcessCommandLine, AccountName\n```\n\n### Step 4: Test with Attack Simulation\n\nValidate detection rules using Atomic Red Team:\n\n```bash\n# Install Atomic Red Team\nIEX (IWR 'https:\u002F\u002Fraw.githubusercontent.com\u002Fredcanaryco\u002Finvoke-atomicredteam\u002Fmaster\u002Finstall-atomicredteam.ps1' -UseBasicParsing)\nInstall-AtomicRedTeam -getAtomics\n\n# Execute T1003.001 - Credential Dumping\nInvoke-AtomicTest T1003.001 -TestNumbers 1,2,3\n\n# Execute T1053.005 - Scheduled Task\nInvoke-AtomicTest T1053.005 -TestNumbers 1\n\n# Execute T1547.001 - Registry Run Key\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2\n```\n\nVerify detection in SIEM:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nearliest=-1h\n| stats count by Computer, SourceImage, GrantedAccess\n| where count > 0\n```\n\nDocument test results:\n```\nTEST RESULTS — UC-2024-015\nAtomic Test T1003.001-1 (Mimikatz):      DETECTED (alert fired in 47s)\nAtomic Test T1003.001-2 (ProcDump):      DETECTED (alert fired in 32s)\nAtomic Test T1003.001-3 (Task Manager):  FALSE NEGATIVE (excluded by whitelist — expected)\nFalse Positive Rate (7-day backtest):     2 events (CrowdStrike scan — added to whitelist)\n```\n\n### Step 5: Deploy and Monitor Use Case Health\n\nTrack detection rule effectiveness:\n\n```spl\n-- Use case firing frequency\nindex=notable\n| stats count AS fires, dc(src) AS unique_sources,\n        dc(dest) AS unique_dests\n  by rule_name, status_label\n| eval true_positive_rate = round(\n    sum(eval(if(status_label=\"Resolved - True Positive\", 1, 0))) \u002F\n    count * 100, 1)\n| sort - fires\n| table rule_name, fires, unique_sources, unique_dests, true_positive_rate\n\n-- Detection latency monitoring\nindex=notable\n| eval detection_latency = _time - orig_time\n| stats avg(detection_latency) AS avg_latency_sec,\n        perc95(detection_latency) AS p95_latency_sec\n  by rule_name\n| eval avg_latency_min = round(avg_latency_sec \u002F 60, 1)\n| sort - avg_latency_sec\n```\n\n### Step 6: Maintain Use Case Library\n\nEstablish lifecycle management for all detection use cases:\n\n```\nUSE CASE LIFECYCLE\n━━━━━━━━━━━━━━━━━━\n1. PROPOSED    → New detection need identified (threat intel, gap analysis, incident finding)\n2. DEVELOPMENT → Query written, false positive analysis, tuning\n3. TESTING     → Atomic Red Team validation, 7-day backtest\n4. STAGING     → Deployed in alert-only mode (no incident creation) for 14 days\n5. PRODUCTION  → Full production with incident creation and SOAR integration\n6. REVIEW      → Quarterly review of effectiveness, false positive rate, relevance\n7. DEPRECATED  → Technique no longer relevant or replaced by better detection\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Use Case** | Formalized detection rule with documented logic, testing, tuning, and lifecycle management |\n| **Detection Engineering** | Practice of designing, testing, and maintaining SIEM detection rules as a software development discipline |\n| **Correlation Search** | SIEM query that combines events from multiple sources to identify attack patterns |\n| **False Positive Rate** | Percentage of alerts that are benign activity — target \u003C20% for production use cases |\n| **Detection Latency** | Time between event occurrence and alert generation — target \u003C5 minutes for critical detections |\n| **ATT&CK Coverage** | Percentage of relevant ATT&CK techniques with at least one production detection rule |\n\n## Tools & Systems\n\n- **Splunk ES**: Enterprise SIEM with correlation searches, risk-based alerting, and Incident Review\n- **Elastic Security**: SIEM with detection rules, EQL sequences, and ML-based anomaly detection\n- **Microsoft Sentinel**: Cloud SIEM with KQL analytics rules, Fusion ML engine, and Lighthouse multi-tenant\n- **Atomic Red Team**: Open-source attack simulation framework for testing detection rules against ATT&CK techniques\n- **ATT&CK Navigator**: MITRE visualization tool for mapping and tracking detection coverage across techniques\n\n## Common Scenarios\n\n- **Post-Incident Use Case**: After a ransomware incident, build detection for the initial access vector discovered during investigation\n- **Compliance-Driven**: PCI DSS requires detection of admin account misuse — build use cases for 4672\u002F4720\u002F4732 events\n- **Threat-Intel Driven**: New APT group targets your sector — build use cases for their documented TTPs\n- **Red Team Findings**: Purple team exercise identifies blind spots — convert findings into production detection rules\n- **SIEM Migration**: Migrating from QRadar to Splunk — convert and validate all existing use cases on new platform\n\n## Output Format\n\n```\nUSE CASE DEPLOYMENT REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━\nQuarter:      Q1 2024\nTotal Use Cases: 147 (Production: 128, Staging: 12, Development: 7)\n\nNew Deployments This Quarter:\n  UC-2024-012  Kerberoasting Detection (T1558.003)     — Production\n  UC-2024-013  DLL Side-Loading (T1574.002)            — Production\n  UC-2024-014  Scheduled Task Persistence (T1053.005)  — Production\n  UC-2024-015  LSASS Memory Access (T1003.001)         — Staging\n\nATT&CK Coverage:\n  Overall: 67% of relevant techniques (up from 61%)\n  Initial Access:      78%\n  Execution:           82%\n  Persistence:         71%\n  Credential Access:   65%\n  Lateral Movement:    58% (priority gap area)\n\nHealth Metrics:\n  Avg True Positive Rate:    74% (target: >70%)\n  Avg Detection Latency:     2.3 min (target: \u003C5 min)\n  Use Cases Deprecated:      3 (replaced by improved versions)\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"nist_ai_rmf":60,"mitre_attack":64,"atlas_techniques":70,"d3fend_techniques":74},[37,25,50,27,38,36,34,33],"use-cases","mahipal","1.0",[54,55,56,57],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.\n",[61,62,63],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[65,66,67,68,69],"T1078","T1685.002","T1685.005","T1566","T0816",[71,72,73],"AML.T0070","AML.T0066","AML.T0082",[75,76,77,78,79],"Token Binding","Restore Access","Password Authentication","Reissue Credential","Strong Password Policy","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-siem-use-cases-for-detection",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":91,"prompt":101,"zipAvailable":102},[92,95,98],{"tool":93,"command":94},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-siem-use-cases-for-detection",{"tool":96,"command":97},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-siem-use-cases-for-detection",{"tool":99,"command":100},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-siem-use-cases-for-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002FSKILL.md",true,[104,109,115],{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002FLICENSE",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fapi-reference.md","REFERENCE","参考文档",2138,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002Freferences\u002Fapi-reference.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",8876,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002Fscripts\u002Fagent.py",[122,149,172,198,224,251],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,134,43,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,134,35,43,137,160,161,162,163,164,165,166,167,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,183,184,185,186,43,187,188,160,189,190,191,192,193,26,30,194,195,196,197],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[204],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[206,207,208,43,209,210,211,212,213,214,215,216,217,218,219,220,163,221,222,223],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[230],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[232,233,234,43,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,259,43,25,260,261,37,262,263,264,265,30,266,194,267,268,269,270,271,272],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]