SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
tuning-detections-to-reduce-false-positives
0
Tunes noisy detections by analyzing historical alert data to quantify false-positive sources, recommend allow-list filters and threshold adjustments, and measure precision impact. Activates for requests to tune a detection, reduce false positives, or analyze alert noise and recommend filters.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Tuning Detections to Reduce False Positives ## When to Use - A detection generates excessive false positives and you want a data-driven tuning plan: which fields/values drive the noise, what filters to add, and the precision impact. - You are balancing recall against alert fatigue. **Do not use** tuning that suppresses true positives — filters must target benign noise, not the malicious pattern. Always estimate the impact on true positives before applying. ## Prerequisites - Labeled alert history (CSV/JSON) with at least an outcome/label field (true_positive vs false_positive) and the alert's distinguishing fields. ## Workflow ### Step 1: Quantify false-positive sources ```bash python scripts/analyst.py analyze alerts.csv --label verdict --field ParentImage ``` Ranks field values by how much false-positive volume they drive and computes current precision/false-positive rate. ### Step 2: Recommend filters Suggest allow-list filters for values that are overwhelmingly benign (high FP, no/low TP), with the projected precision gain. ### Step 3: Estimate impact Report how many true positives would be lost (should be zero/near-zero for safe filters). ### Step 4: Apply and monitor Add the safe filters to the rule's `filter`/exclusion and continue monitoring precision. ## Validation - FP-driving values are ranked by their false-positive contribution. - Recommended filters target values with negligible true-positive loss. - Projected precision and TP-loss are reported. ## Pitfalls - Filtering a value that also carries true positives, blinding the detection. - Over-fitting to one time window's noise. - Tuning by gut feel instead of measured FP/TP contribution. ## References - See [`references/api-reference.md`](references/api-reference.md) for the tuner. - Sigma spec and detection-engineering references (linked in frontmatter).