security-detection-rule-management by elastic/agent-skills
npx skills add https://github.com/elastic/agent-skills --skill security-detection-rule-management为新兴威胁和覆盖缺口创建新的检测规则,并调整现有规则以减少误报。所有操作均通过 rule-manager.js 使用 Kibana 检测引擎 API。
首次使用前,请在 skills/security 目录下安装依赖项:
cd skills/security && npm install
设置必需的环境变量(或将它们添加到工作区根目录的 .env 文件中):
export ELASTICSEARCH_URL="https://your-cluster.es.cloud.example.com:443"
export ELASTICSEARCH_API_KEY="your-api-key"
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 任务 | 要调用的工具(按顺序) |
|---|
| 调整嘈杂的 SIEM 规则 | rule_manager find/noisy-rules → run_query(调查误报) → rule_manager patch 或 add-exception |
| 添加终端行为例外 | fetch_endpoint_rule(从 GitHub 获取规则定义) → add_endpoint_exception(限定于 rule.id) |
| 创建新的检测规则 | run_query(针对数据测试查询) → rule_manager create |
| 调查规则警报量 | rule_manager get → run_query(查询警报索引) |
对于终端行为规则,在添加例外之前,务必先获取规则定义以了解查询逻辑和现有排除项。对于 SIEM 规则,在调整之前务必使用 run_query 调查警报模式。
关键: 对于终端行为规则,务必使用 fetch_endpoint_rule(而不是 shell 或直接脚本调用)来获取规则定义,然后使用 add_endpoint_exception 来添加例外。这些是专用工具 — 不要手动调用底层脚本。
使用 noisy-rules 或 find 查找嘈杂规则,然后获取规则定义并调查警报:
node skills/security/detection-rule-management/scripts/rule-manager.js noisy-rules --days 7 --top 20
node skills/security/detection-rule-management/scripts/rule-manager.js find --filter "alert.attributes.name:*Suspicious*" --brief
node skills/security/detection-rule-management/scripts/rule-manager.js get --id <rule_uuid>
node skills/security/alert-triage/scripts/run-query.js "kibana.alert.rule.name:\"<rule_name>\"" --index ".alerts-security.alerts-*" --days 7 --full
寻找模式:相同的进程/用户/主机 → 例外候选;宽泛的模式 → 收紧查询;合法软件 → 例外;过于宽泛 → 重写或调整阈值。
按偏好顺序排列:
添加例外 — 最适合特定的已知良好进程、用户或主机。不修改规则查询。当规则总体上正确,但在已知合法活动上触发时使用。
收紧查询 — 修补规则的查询以排除误报模式。当误报源于查询过于宽泛时最佳。
调整阈值 / 警报抑制 — 对于阈值规则,增加阈值。对于任何规则类型,启用警报抑制以减少同一实体的重复警报。
降低风险评分 / 严重性 — 如果规则产生许多低价值警报但仍有一些检测价值,则降低其优先级。
禁用规则 — 最后的手段。仅当规则没有价值或与另一规则完全冗余时使用。
添加例外(单条件/多条件,通过 matches 使用通配符):
node skills/security/detection-rule-management/scripts/rule-manager.js add-exception \
--rule-uuid <rule_uuid> \
--entries "process.executable:is:C:\\Program Files\\SCCM\\CcmExec.exe" "process.parent.name:is:CcmExec.exe" \
--name "Exclude SCCM" --comment "FP: SCCM deployment" --tags "tuning:fp" "source:soc" --yes
修补查询、阈值、严重性或禁用:
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --query "process.name:powershell.exe AND NOT process.parent.name:CcmExec.exe" --yes
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --max-signals 50 --yes
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --severity low --risk-score 21 --yes
node skills/security/detection-rule-management/scripts/rule-manager.js disable --id <rule_uuid> --yes
写操作(patch、enable、disable、delete、add-exception、bulk-action)默认会提示确认。传递 --yes 以跳过提示(当由代理调用时需要)。
使用 rule-manager.js get --id <rule_uuid> 进行验证。通过 case-management 技能更新分类案例。
指定 MITRE ATT&CK 技术、所需数据源(终端、网络、云)以及恶意与合法行为。常用索引:logs-endpoint.events.process-*、logs-endpoint.events.network-*、.alerts-security.alerts-*、logs-windows.*、logs-aws.*。关键字段:process.name、process.command_line、process.parent.name、destination.ip、winlog.event_id、event.action。使用 run-query.js 验证数据:
node skills/security/alert-triage/scripts/run-query.js "process.name:certutil.exe" --index "logs-endpoint.events.process-*" --days 30 --size 5
规则类型:query(KQL 字段匹配)、eql(事件序列)、esql(聚合)、threshold(基于数量)、threat_match(IOC 关联)、new_terms(首次出现)。在创建前针对 Elasticsearch 进行测试:
node skills/security/alert-triage/scripts/run-query.js "process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)" \
--index "logs-endpoint.events.process-*" --days 30
对于 EQL,使用 --query-file 以避免 shell 转义问题。
在创建或修补规则之前验证查询语法。 validate-query 命令可在本地捕获常见错误 — 转义的反斜杠、括号不匹配、引号不平衡以及重复的布尔运算符:
node skills/security/detection-rule-management/scripts/rule-manager.js validate-query \
--query "process.name:taskkill.exe AND process.command_line:(*chrome.exe* OR *msedge.exe*)" --language kuery
create 和 patch 命令也会自动运行验证并拒绝无效查询。仅当您确信查询正确,尽管触发了检查时,才传递 --skip-validation。
常见的 KQL 语法错误:
*/IM chrome.exe*,而不是 *\/IM chrome.exe*。( 必须有匹配的 )。" 必须成对出现。AND AND 或 OR OR 总是错误。node skills/security/detection-rule-management/scripts/rule-manager.js create \
--name "Certutil URL Download or Decode" \
--description "Detects certutil.exe used to download files or decode Base64 payloads, a common LOLBin technique." \
--type query \
--query "process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)" \
--index "logs-endpoint.events.process-*" \
--severity medium --risk-score 47 \
--tags "OS:Windows" "Tactic:Defense Evasion" "Tactic:Command and Control" \
--false-positives "IT administrators using certutil for legitimate certificate operations" \
--references "https://attack.mitre.org/techniques/T1140/" \
--interval 5m --disabled
对于复杂规则(EQL 序列、MITRE 映射、警报抑制),使用 create --from-file rule_definition.json 和 --threat-file。有关模式,请参阅 references/detection-api-reference.md。
使用 noisy-rules --days 3 --top 10 监控警报量,并根据需要调整误报。
通过添加限定于特定规则的终端例外来调整Elastic 终端行为规则。终端例外位于安全 → 例外 → 终端安全例外列表中,而不是在单个 SIEM 规则下。
关键原则: 始终先从 protections-artifacts 获取规则定义。始终将例外限定于规则(rule.id 或 rule.name)。使用完整路径而非进程名称。在任何例外之前运行强制的实体交叉检查(步骤 4b)。模拟影响(步骤 5b)并力求噪声降低 ≥60%。
脚本: fetch-endpoint-rule-from-github.js(按 id 获取规则 TOML)、add-endpoint-exception.js(添加到终端例外列表;需要 rule.id/rule.name)、check-exclusion-best-practices.js。
有关完整的逐步工作流(步骤 1–6)、查询和模拟模板,请参阅 references/endpoint-behavior-tuning-workflow.md。有关排除最佳实践,请参阅 references/endpoint-rule-exclusion-best-practices.md。
所有命令均从工作区根目录运行。除非注明,所有输出均为 JSON。
| 命令 | 描述 |
|---|---|
find | 使用可选的 KQL 过滤器搜索/列出规则 |
get | 通过 --id 或 --rule-id 获取规则 |
create | 创建规则(内联标志或 --from-file) |
patch | 修补规则上的特定字段 |
enable | 启用规则 |
disable | 禁用规则 |
delete | 删除规则 |
export | 将规则导出为 NDJSON |
bulk-action | 批量启用/禁用/删除/复制/编辑 |
add-exception | 向规则添加例外项 |
list-exceptions | 列出例外列表中的项 |
create-shared-list | 创建共享例外列表 |
noisy-rules | 按警报量查找最嘈杂的规则 |
validate-query | 在创建/修补前检查查询语法 |
终端行为调整: fetch-endpoint-rule-from-github.js(按 id 获取规则 TOML)、add-endpoint-exception.js(添加到终端例外列表;需要 rule.id/rule.name)、check-exclusion-best-practices.js。
将条目传递为 field:operator:value。运算符:is、is_not、is_one_of、is_not_one_of、exists、does_not_exist、matches、does_not_match。示例:process.name:is:svchost.exe、file.path:matches:C:\\Program Files\\*。
alert-triage 技能case-management 技能create、patch、enable、disable、delete、add-exception、bulk-action、add-endpoint-exception)都会提示确认。当由代理调用时,传递 --yes 或 -y 以跳过。rule.id 或 rule.name 将例外限定于特定规则。宽泛的、未限定范围的例外可能会悄无声息地降低检测覆盖率。--dry-run 与 bulk-action 预览影响。| 变量 | 必需 | 描述 |
|---|---|---|
ELASTICSEARCH_URL | 是 | Elasticsearch URL(用于 noisy-rules 聚合) |
ELASTICSEARCH_API_KEY | 是 | Elasticsearch API 密钥 |
KIBANA_URL | 是 | Kibana URL(用于规则 API) |
KIBANA_API_KEY | 是 | Kibana API 密钥 |
每周安装次数
128
仓库
GitHub 星标数
89
首次出现
11 天前
安全审计
安装于
cursor116
opencode108
github-copilot108
codex108
kimi-cli108
amp108
Create new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives. All operations use the Kibana Detection Engine API via rule-manager.js.
Install dependencies before first use from the skills/security directory:
cd skills/security && npm install
Set the required environment variables (or add them to a .env file in the workspace root):
export ELASTICSEARCH_URL="https://your-cluster.es.cloud.example.com:443"
export ELASTICSEARCH_API_KEY="your-api-key"
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
| Task | Tools to call (in order) |
|---|---|
| Tune noisy SIEM rule | rule_manager find/noisy-rules → run_query (investigate FPs) → rule_manager patch or add-exception |
| Add endpoint behavior exception | fetch_endpoint_rule (get rule definition from GitHub) → add_endpoint_exception (scoped to rule.id) |
| Create new detection rule | run_query (test query against data) → rule_manager create |
For endpoint behavior rules, always fetch the rule definition first to understand query logic and existing exclusions before adding an exception. For SIEM rules, always investigate alert patterns with run_query before tuning.
Critical: For endpoint behavior rules, always use fetch_endpoint_rule (not shell or direct script calls) to get the rule definition, then use add_endpoint_exception to add the exception. These are dedicated tools — do not invoke the underlying scripts manually.
Find noisy rules with noisy-rules or find, then get the rule definition and investigate alerts:
node skills/security/detection-rule-management/scripts/rule-manager.js noisy-rules --days 7 --top 20
node skills/security/detection-rule-management/scripts/rule-manager.js find --filter "alert.attributes.name:*Suspicious*" --brief
node skills/security/detection-rule-management/scripts/rule-manager.js get --id <rule_uuid>
node skills/security/alert-triage/scripts/run-query.js "kibana.alert.rule.name:\"<rule_name>\"" --index ".alerts-security.alerts-*" --days 7 --full
Look for patterns: same process/user/host → exception candidate; broad pattern → tighten query; legitimate software → exception; too broad → rewrite or adjust threshold.
In order of preference:
Add exception — Best for specific known-good processes, users, or hosts. Does not modify the rule query. Use when the rule is correct in general but fires on known-legitimate activity.
Tighten the query — Patch the rule's query to exclude the FP pattern. Best when the false positives stem from the query being too broad.
Adjust threshold / alert suppression — For threshold rules, increase the threshold value. For any rule type, enable alert suppression to reduce duplicate alerts on the same entity.
Reduce risk score / severity — Downgrade the rule's priority if it generates many low-value alerts but still has some detection value.
Disable the rule — Last resort. Only if the rule provides no value or is completely redundant with another rule.
Add exception (single/multi-condition, wildcard via matches):
node skills/security/detection-rule-management/scripts/rule-manager.js add-exception \
--rule-uuid <rule_uuid> \
--entries "process.executable:is:C:\\Program Files\\SCCM\\CcmExec.exe" "process.parent.name:is:CcmExec.exe" \
--name "Exclude SCCM" --comment "FP: SCCM deployment" --tags "tuning:fp" "source:soc" --yes
Patch query, threshold, severity, or disable:
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --query "process.name:powershell.exe AND NOT process.parent.name:CcmExec.exe" --yes
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --max-signals 50 --yes
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --severity low --risk-score 21 --yes
node skills/security/detection-rule-management/scripts/rule-manager.js disable --id <rule_uuid> --yes
Write operations (patch, enable, disable, delete, add-exception, bulk-action) prompt for confirmation by default. Pass --yes to skip the prompt (required when called by an agent).
Verify with rule-manager.js get --id <rule_uuid>. Update triage cases via the case-management skill.
Specify MITRE ATT&CK technique(s), required data sources (Endpoint, Network, Cloud), and malicious vs legitimate behavior. Common indexes: logs-endpoint.events.process-*, logs-endpoint.events.network-*, .alerts-security.alerts-*, logs-windows.*, logs-aws.*. Key fields: process.name, process.command_line, process.parent.name, destination.ip, winlog.event_id, event.action. Verify data with :
node skills/security/alert-triage/scripts/run-query.js "process.name:certutil.exe" --index "logs-endpoint.events.process-*" --days 30 --size 5
Rule types: query (KQL field matching), eql (event sequences), esql (aggregations), threshold (volume-based), threat_match (IOC correlation), new_terms (first-seen). Test against Elasticsearch before creating:
node skills/security/alert-triage/scripts/run-query.js "process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)" \
--index "logs-endpoint.events.process-*" --days 30
For EQL, use --query-file to avoid shell escaping issues.
Validate query syntax before creating or patching a rule. The validate-query command catches common errors locally — escaped backslashes, mismatched parentheses, unbalanced quotes, and duplicate boolean operators:
node skills/security/detection-rule-management/scripts/rule-manager.js validate-query \
--query "process.name:taskkill.exe AND process.command_line:(*chrome.exe* OR *msedge.exe*)" --language kuery
The create and patch commands also run validation automatically and reject invalid queries. Pass --skip-validation only if you are certain the query is correct despite triggering a check.
Common KQL syntax mistakes:
*/IM chrome.exe*, not *\/IM chrome.exe*.( must have a matching )." must be paired.AND AND or OR OR is always an error.node skills/security/detection-rule-management/scripts/rule-manager.js create \
--name "Certutil URL Download or Decode" \
--description "Detects certutil.exe used to download files or decode Base64 payloads, a common LOLBin technique." \
--type query \
--query "process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)" \
--index "logs-endpoint.events.process-*" \
--severity medium --risk-score 47 \
--tags "OS:Windows" "Tactic:Defense Evasion" "Tactic:Command and Control" \
--false-positives "IT administrators using certutil for legitimate certificate operations" \
--references "https://attack.mitre.org/techniques/T1140/" \
--interval 5m --disabled
For complex rules (EQL sequences, MITRE mappings, alert suppression), use create --from-file rule_definition.json and --threat-file. See references/detection-api-reference.md for schema.
Monitor alert volume with noisy-rules --days 3 --top 10 and tune false positives as needed.
Tune Elastic Endpoint behavior rules by adding Endpoint exceptions scoped to specific rules. Endpoint exceptions live in Security → Exceptions → Endpoint Security Exception List , not under individual SIEM rules.
Key principles: Always fetch the rule definition from protections-artifacts first. Always scope exceptions to the rule (rule.id or rule.name). Use full paths over process names. Run the mandatory entity cross-check (Step 4b) before any exception. Simulate impact (Step 5b) and aim for ≥60% noise reduction.
Scripts: fetch-endpoint-rule-from-github.js (get rule TOML by id), add-endpoint-exception.js (add to Endpoint Exception List; rule.id/rule.name required), check-exclusion-best-practices.js.
For the full step-by-step workflow (Steps 1–6), queries, and simulation templates, see references/endpoint-behavior-tuning-workflow.md. For exclusion best practices, see references/endpoint-rule-exclusion-best-practices.md.
All commands are run from the workspace root. All output is JSON unless noted.
| Command | Description |
|---|---|
find | Search/list rules with optional KQL filter |
get | Get a rule by --id or --rule-id |
create | Create a rule (inline flags or --from-file) |
patch | Patch specific fields on a rule |
enable |
Endpoint behavior tuning: fetch-endpoint-rule-from-github.js (get rule TOML by id), add-endpoint-exception.js (add to Endpoint Exception List; rule.id/rule.name required), check-exclusion-best-practices.js.
Pass entries as field:operator:value. Operators: is, is_not, is_one_of, is_not_one_of, exists, does_not_exist, matches, does_not_match. Example: process.name:is:svchost.exe, file.path:matches:C:\\Program Files\\*.
alert-triage skillcase-management skillcreate, patch, enable, disable, delete, add-exception, bulk-action, add-endpoint-exception) prompt for confirmation. Pass --yes or -y to skip when called by an agent.rule.id or in the entries. A broad, unscoped exception can silently reduce detection coverage.| Variable | Required | Description |
|---|---|---|
ELASTICSEARCH_URL | Yes | Elasticsearch URL (for noisy-rules aggregation) |
ELASTICSEARCH_API_KEY | Yes | Elasticsearch API key |
KIBANA_URL | Yes | Kibana URL (for rules API) |
KIBANA_API_KEY | Yes | Kibana API key |
Weekly Installs
128
Repository
GitHub Stars
89
First Seen
11 days ago
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
cursor116
opencode108
github-copilot108
codex108
kimi-cli108
amp108
GitHub Actions 官方文档查询助手 - 精准解答 CI/CD 工作流问题
45,200 周安装
MySQL数据库优化实战指南:索引设计、查询优化与事务管理最佳实践
2,200 周安装
Python Office自动化脚本:Word/Excel批量处理、模板填充、数据合并与分析
2,200 周安装
微信小程序开发指南 - 腾讯云CloudBase集成、调试发布与项目结构最佳实践
2,200 周安装
Payload CMS 开发指南:TypeScript 原生 CMS 与 Next.js 集成教程
2,200 周安装
Ultracite:零配置的JS/TS代码检查与格式化工具,支持Biome/ESLint/Oxlint
2,300 周安装
技术性SEO检查器 - 专业网站技术SEO诊断与优化工具
2,200 周安装
| Investigate rule alert volume | rule_manager get → run_query (query alerts index) |
run-query.js| Enable a rule |
disable | Disable a rule |
delete | Delete a rule |
export | Export rules as NDJSON |
bulk-action | Bulk enable/disable/delete/duplicate/edit |
add-exception | Add an exception item to a rule |
list-exceptions | List items on an exception list |
create-shared-list | Create a shared exception list |
noisy-rules | Find noisiest rules by alert volume |
validate-query | Check query syntax before create/patch |
rule.name--dry-run with bulk-action to preview impact before executing bulk changes.