[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-security-detection-rule-management":3,"mdc-spvsie-key":34,"related-org-elastic-security-detection-rule-management":3109,"related-repo-elastic-security-detection-rule-management":3279},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"security-detection-rule-management","manage Elastic Security detection rules","Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Monitoring","monitoring",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Kibana","kibana",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:49:33.582904",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fsecurity\u002Fdetection-rule-management","---\nname: security-detection-rule-management\ndescription: >\n  Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use\n  for false positives, exceptions, new coverage, noisy rules, or rule management via\n  Kibana API.\ncompatibility: >\n  Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables:\n  KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME\u002FKIBANA_PASSWORD; ELASTICSEARCH_URL\n  or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Detection Rule Management\n\nCreate new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives.\nAll operations use the Kibana Detection Engine API via `rule-manager.js`.\n\n## Execution rules\n\n- Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.\n- Report tool output faithfully. Copy rule IDs, names, alert counts, exception IDs, and error messages exactly as\n  returned by the API. Do not abbreviate rule UUIDs, invent rule names, or round alert counts.\n- When a tool returns an error (rule not found, API failure), report the exact error — do not guess at alternatives.\n\n## Prerequisites\n\nInstall dependencies before first use from the `skills\u002Fsecurity` directory:\n\n```bash\ncd skills\u002Fsecurity && npm install\n```\n\nSet the required environment variables (or add them to a `.env` file in the workspace root):\n\n```bash\nexport ELASTICSEARCH_URL=\"https:\u002F\u002Fyour-cluster.es.cloud.example.com:443\"\nexport ELASTICSEARCH_API_KEY=\"your-api-key\"\nexport KIBANA_URL=\"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443\"\nexport KIBANA_API_KEY=\"your-kibana-api-key\"\n```\n\n## Common multi-step workflows\n\n| Task                                | Tools to call (in order)                                                                                |\n| ----------------------------------- | ------------------------------------------------------------------------------------------------------- |\n| **Tune noisy SIEM rule**            | `rule_manager` find\u002Fnoisy-rules → `run_query` (investigate FPs) → `rule_manager` patch or add-exception |\n| **Add endpoint behavior exception** | `fetch_endpoint_rule` (get rule definition from GitHub) → `add_endpoint_exception` (scoped to rule.id)  |\n| **Create new detection rule**       | `run_query` (test query against data) → `rule_manager` create                                           |\n| **Investigate rule alert volume**   | `rule_manager` get → `run_query` (query alerts index)                                                   |\n\nFor endpoint behavior rules, always fetch the rule definition first to understand query logic and existing exclusions\nbefore adding an exception. For SIEM rules, always investigate alert patterns with `run_query` before tuning.\n\n**Critical:** For endpoint behavior rules, always use `fetch_endpoint_rule` (not `shell` or direct script calls) to get\nthe rule definition, then use `add_endpoint_exception` to add the exception. These are dedicated tools — do not invoke\nthe underlying scripts manually.\n\n## Workflow: Tune a rule for false positives\n\n### Steps 1–2: Identify noisy rules and analyze false positives\n\nFind noisy rules with `noisy-rules` or `find`, then get the rule definition and investigate alerts:\n\n```bash\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js noisy-rules --days 7 --top 20\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js find --filter \"alert.attributes.name:*Suspicious*\" --brief\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js get --id \u003Crule_uuid>\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"kibana.alert.rule.name:\\\"\u003Crule_name>\\\"\" --index \".alerts-security.alerts-*\" --days 7 --full\n```\n\nLook for patterns: same process\u002Fuser\u002Fhost → exception candidate; broad pattern → tighten query; legitimate software →\nexception; too broad → rewrite or adjust threshold.\n\n### Step 3: Choose a tuning strategy\n\n**In order of preference:**\n\n1. **Add exception** — Best for specific known-good processes, users, or hosts. Does not modify the rule query. Use when\n   the rule is correct in general but fires on known-legitimate activity.\n\n2. **Tighten the query** — Patch the rule's query to exclude the FP pattern. Best when the false positives stem from the\n   query being too broad.\n\n3. **Adjust threshold \u002F alert suppression** — For threshold rules, increase the threshold value. For any rule type,\n   enable alert suppression to reduce duplicate alerts on the same entity.\n\n4. **Reduce risk score \u002F severity** — Downgrade the rule's priority if it generates many low-value alerts but still has\n   some detection value.\n\n5. **Disable the rule** — Last resort. Only if the rule provides no value or is completely redundant with another rule.\n\n### Steps 4–5: Apply tuning, verify, and document\n\n**Add exception** (single\u002Fmulti-condition, wildcard via `matches`):\n\n```bash\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js add-exception \\\n  --rule-uuid \u003Crule_uuid> \\\n  --entries \"process.executable:is:C:\\\\Program Files\\\\SCCM\\\\CcmExec.exe\" \"process.parent.name:is:CcmExec.exe\" \\\n  --name \"Exclude SCCM\" --comment \"FP: SCCM deployment\" --tags \"tuning:fp\" \"source:soc\" --yes\n```\n\n**Patch query, threshold, severity, or disable:**\n\n```bash\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js patch --id \u003Crule_uuid> --query \"process.name:powershell.exe AND NOT process.parent.name:CcmExec.exe\" --yes\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js patch --id \u003Crule_uuid> --max-signals 50 --yes\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js patch --id \u003Crule_uuid> --severity low --risk-score 21 --yes\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js disable --id \u003Crule_uuid> --yes\n```\n\nWrite operations (`patch`, `enable`, `disable`, `delete`, `add-exception`, `bulk-action`) prompt for confirmation by\ndefault. Pass `--yes` to skip the prompt (required when called by an agent).\n\nVerify with `rule-manager.js get --id \u003Crule_uuid>`. Update triage cases via the `case-management` skill.\n\n---\n\n## Workflow: Create new detection rule\n\n### Steps 1–2: Define the threat, data sources, and fields\n\nSpecify MITRE ATT&CK technique(s), required data sources (Endpoint, Network, Cloud), and malicious vs legitimate\nbehavior. Common indexes: `logs-endpoint.events.process-*`, `logs-endpoint.events.network-*`,\n`.alerts-security.alerts-*`, `logs-windows.*`, `logs-aws.*`. Key fields: `process.name`, `process.command_line`,\n`process.parent.name`, `destination.ip`, `winlog.event_id`, `event.action`. Verify data with `run-query.js`:\n\n```bash\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"process.name:certutil.exe\" --index \"logs-endpoint.events.process-*\" --days 30 --size 5\n```\n\n### Step 3: Write and test the query\n\nRule types: `query` (KQL field matching), `eql` (event sequences), `esql` (aggregations), `threshold` (volume-based),\n`threat_match` (IOC correlation), `new_terms` (first-seen). Test against Elasticsearch before creating:\n\n```bash\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)\" \\\n  --index \"logs-endpoint.events.process-*\" --days 30\n```\n\nFor EQL, use `--query-file` to avoid shell escaping issues.\n\n**Validate query syntax before creating or patching a rule.** The `validate-query` command catches common errors locally\n— escaped backslashes, mismatched parentheses, unbalanced quotes, and duplicate boolean operators:\n\n```bash\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js validate-query \\\n  --query \"process.name:taskkill.exe AND process.command_line:(*chrome.exe* OR *msedge.exe*)\" --language kuery\n```\n\nThe `create` and `patch` commands also run validation automatically and reject invalid queries. Pass `--skip-validation`\nonly if you are certain the query is correct despite triggering a check.\n\nCommon KQL syntax mistakes:\n\n- **Escaped forward-slashes** — KQL wildcards use plain text. Write `*\u002FIM chrome.exe*`, not `*\\\u002FIM chrome.exe*`.\n- **Mismatched parentheses** — every `(` must have a matching `)`.\n- **Unbalanced quotes** — every `\"` must be paired.\n- **Duplicate operators** — `AND AND` or `OR OR` is always an error.\n\n### Step 4: Create the rule\n\n```bash\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js create \\\n  --name \"Certutil URL Download or Decode\" \\\n  --description \"Detects certutil.exe used to download files or decode Base64 payloads, a common LOLBin technique.\" \\\n  --type query \\\n  --query \"process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)\" \\\n  --index \"logs-endpoint.events.process-*\" \\\n  --severity medium --risk-score 47 \\\n  --tags \"OS:Windows\" \"Tactic:Defense Evasion\" \"Tactic:Command and Control\" \\\n  --false-positives \"IT administrators using certutil for legitimate certificate operations\" \\\n  --references \"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1140\u002F\" \\\n  --interval 5m --disabled\n```\n\nFor complex rules (EQL sequences, MITRE mappings, alert suppression), use `create --from-file rule_definition.json` and\n`--threat-file`. See [references\u002Fdetection-api-reference.md](references\u002Fdetection-api-reference.md) for schema.\n\n### Step 5: Monitor and iterate\n\nMonitor alert volume with `noisy-rules --days 3 --top 10` and tune false positives as needed.\n\n---\n\n## Workflow: Endpoint behavior rules tuning\n\nTune **Elastic Endpoint behavior rules** by adding **Endpoint exceptions** scoped to specific rules. Endpoint exceptions\nlive in **Security → Exceptions → Endpoint Security Exception List**, not under individual SIEM rules.\n\n**Key principles:** Always fetch the rule definition from protections-artifacts first. Always scope exceptions to the\nrule (`rule.id` or `rule.name`). Use full paths over process names. Run the mandatory entity cross-check (Step 4b)\nbefore any exception. Simulate impact (Step 5b) and aim for ≥60% noise reduction.\n\n**Scripts:** `fetch-endpoint-rule-from-github.js` (get rule TOML by id), `add-endpoint-exception.js` (add to Endpoint\nException List; rule.id\u002Frule.name required), `check-exclusion-best-practices.js`.\n\nFor the full step-by-step workflow (Steps 1–6), queries, and simulation templates, see\n[references\u002Fendpoint-behavior-tuning-workflow.md](references\u002Fendpoint-behavior-tuning-workflow.md). For exclusion best\npractices, see\n[references\u002Fendpoint-rule-exclusion-best-practices.md](references\u002Fendpoint-rule-exclusion-best-practices.md).\n\n---\n\n## Tool reference\n\n### rule-manager.js\n\nAll commands are run from the workspace root. All output is JSON unless noted.\n\n| Command              | Description                                   |\n| -------------------- | --------------------------------------------- |\n| `find`               | Search\u002Flist rules with optional KQL filter    |\n| `get`                | Get a rule by `--id` or `--rule-id`           |\n| `create`             | Create a rule (inline flags or `--from-file`) |\n| `patch`              | Patch specific fields on a rule               |\n| `enable`             | Enable a rule                                 |\n| `disable`            | Disable a rule                                |\n| `delete`             | Delete a rule                                 |\n| `export`             | Export rules as NDJSON                        |\n| `bulk-action`        | Bulk enable\u002Fdisable\u002Fdelete\u002Fduplicate\u002Fedit     |\n| `add-exception`      | Add an exception item to a rule               |\n| `list-exceptions`    | List items on an exception list               |\n| `create-shared-list` | Create a shared exception list                |\n| `noisy-rules`        | Find noisiest rules by alert volume           |\n| `validate-query`     | Check query syntax before create\u002Fpatch        |\n\n**Endpoint behavior tuning:** `fetch-endpoint-rule-from-github.js` (get rule TOML by id), `add-endpoint-exception.js`\n(add to Endpoint Exception List; rule.id\u002Frule.name required), `check-exclusion-best-practices.js`.\n\n### Exception entry format\n\nPass entries as `field:operator:value`. Operators: `is`, `is_not`, `is_one_of`, `is_not_one_of`, `exists`,\n`does_not_exist`, `matches`, `does_not_match`. Example: `process.name:is:svchost.exe`,\n`file.path:matches:C:\\\\Program Files\\\\*`.\n\n## Additional resources\n\n- For full API schema details, see [references\u002Fdetection-api-reference.md](references\u002Fdetection-api-reference.md)\n- For **endpoint behavior** tuning: [references\u002Fendpoint-exceptions-guide.md](references\u002Fendpoint-exceptions-guide.md),\n  [references\u002Fendpoint-rule-exclusion-best-practices.md](references\u002Fendpoint-rule-exclusion-best-practices.md)\n- For alert investigation during tuning, use the `alert-triage` skill\n- For documenting tuning actions in cases, use the `case-management` skill\n\n## Examples\n\n- \"Find the noisiest detection rules from the last 7 days and help me tune one\"\n- \"Add an exception to exclude SCCM from the suspicious PowerShell rule\"\n- \"Create a new detection rule for certutil URL download or decode\"\n\n## Guidelines\n\n- **Report only tool output.** When summarizing results, quote or paraphrase only what the tools returned. Do not invent\n  IDs, hostnames, IPs, scores, process trees, or other details not present in the tool response.\n- **Preserve identifiers from the request.** If the user provides specific hostnames, agent IDs, case IDs, or other\n  values, use those exact values in tool calls and responses — do not substitute different identifiers.\n- **Confirm actions concisely.** After executing a tool, confirm what was done using the tool's return data. Do not\n  fabricate internal IDs, metadata, or status details unless they appear in the tool response.\n- **Distinguish facts from inference.** If you draw conclusions beyond what the tools returned (e.g., suggesting a MITRE\n  technique based on observed behavior), clearly label those as your assessment rather than presenting them as tool\n  output.\n- **Start executing tools immediately.** Do not read SKILL.md, browse directories, or list files before acting.\n- **Report tool output verbatim.** Copy rule IDs, names, alert counts, and error messages exactly as returned. Do not\n  abbreviate UUIDs or round numbers.\n\n## Production use\n\n- All write operations (`create`, `patch`, `enable`, `disable`, `delete`, `add-exception`, `bulk-action`,\n  `add-endpoint-exception`) prompt for confirmation. Pass `--yes` or `-y` to skip when called by an agent.\n- **Endpoint exceptions suppress detections globally.** Always scope exceptions to a specific rule using `rule.id` or\n  `rule.name` in the entries. A broad, unscoped exception can silently reduce detection coverage.\n- Verify environment variables point to the intended cluster before running any script.\n- Use `--dry-run` with `bulk-action` to preview impact before executing bulk changes.\n\n## Environment variables\n\n| Variable                | Required | Description                                     |\n| ----------------------- | -------- | ----------------------------------------------- |\n| `ELASTICSEARCH_URL`     | Yes      | Elasticsearch URL (for noisy-rules aggregation) |\n| `ELASTICSEARCH_API_KEY` | Yes      | Elasticsearch API key                           |\n| `KIBANA_URL`            | Yes      | Kibana URL (for rules API)                      |\n| `KIBANA_API_KEY`        | Yes      | Kibana API key                                  |\n",{"data":35,"body":39},{"name":4,"description":6,"compatibility":36,"metadata":37},"Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables: KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME\u002FKIBANA_PASSWORD; ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD.\n",{"author":8,"version":38},"0.1.0",{"type":40,"children":41},"root",[42,51,66,73,93,99,112,158,171,303,309,461,473,505,511,518,539,736,741,747,755,809,815,832,1030,1038,1251,1308,1329,1333,1339,1345,1437,1503,1509,1562,1626,1639,1657,1715,1743,1748,1842,1848,2138,2167,2173,2186,2189,2195,2221,2246,2279,2297,2300,2306,2311,2316,2585,2613,2619,2702,2708,2766,2772,2790,2796,2859,2865,2986,2992,3103],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"detection-rule-management",[48],{"type":49,"value":50},"text","Detection Rule Management",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55,57,64],{"type":49,"value":56},"Create new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives.\nAll operations use the Kibana Detection Engine API via ",{"type":43,"tag":58,"props":59,"children":61},"code",{"className":60},[],[62],{"type":49,"value":63},"rule-manager.js",{"type":49,"value":65},".",{"type":43,"tag":67,"props":68,"children":70},"h2",{"id":69},"execution-rules",[71],{"type":49,"value":72},"Execution rules",{"type":43,"tag":74,"props":75,"children":76},"ul",{},[77,83,88],{"type":43,"tag":78,"props":79,"children":80},"li",{},[81],{"type":49,"value":82},"Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.",{"type":43,"tag":78,"props":84,"children":85},{},[86],{"type":49,"value":87},"Report tool output faithfully. Copy rule IDs, names, alert counts, exception IDs, and error messages exactly as\nreturned by the API. Do not abbreviate rule UUIDs, invent rule names, or round alert counts.",{"type":43,"tag":78,"props":89,"children":90},{},[91],{"type":49,"value":92},"When a tool returns an error (rule not found, API failure), report the exact error — do not guess at alternatives.",{"type":43,"tag":67,"props":94,"children":96},{"id":95},"prerequisites",[97],{"type":49,"value":98},"Prerequisites",{"type":43,"tag":52,"props":100,"children":101},{},[102,104,110],{"type":49,"value":103},"Install dependencies before first use from the ",{"type":43,"tag":58,"props":105,"children":107},{"className":106},[],[108],{"type":49,"value":109},"skills\u002Fsecurity",{"type":49,"value":111}," directory:",{"type":43,"tag":113,"props":114,"children":119},"pre",{"className":115,"code":116,"language":117,"meta":118,"style":118},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cd skills\u002Fsecurity && npm install\n","bash","",[120],{"type":43,"tag":58,"props":121,"children":122},{"__ignoreMap":118},[123],{"type":43,"tag":124,"props":125,"children":128},"span",{"class":126,"line":127},"line",1,[129,135,141,147,153],{"type":43,"tag":124,"props":130,"children":132},{"style":131},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[133],{"type":49,"value":134},"cd",{"type":43,"tag":124,"props":136,"children":138},{"style":137},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[139],{"type":49,"value":140}," skills\u002Fsecurity",{"type":43,"tag":124,"props":142,"children":144},{"style":143},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[145],{"type":49,"value":146}," &&",{"type":43,"tag":124,"props":148,"children":150},{"style":149},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[151],{"type":49,"value":152}," npm",{"type":43,"tag":124,"props":154,"children":155},{"style":137},[156],{"type":49,"value":157}," install\n",{"type":43,"tag":52,"props":159,"children":160},{},[161,163,169],{"type":49,"value":162},"Set the required environment variables (or add them to a ",{"type":43,"tag":58,"props":164,"children":166},{"className":165},[],[167],{"type":49,"value":168},".env",{"type":49,"value":170}," file in the workspace root):",{"type":43,"tag":113,"props":172,"children":174},{"className":115,"code":173,"language":117,"meta":118,"style":118},"export ELASTICSEARCH_URL=\"https:\u002F\u002Fyour-cluster.es.cloud.example.com:443\"\nexport ELASTICSEARCH_API_KEY=\"your-api-key\"\nexport KIBANA_URL=\"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443\"\nexport KIBANA_API_KEY=\"your-kibana-api-key\"\n",[175],{"type":43,"tag":58,"props":176,"children":177},{"__ignoreMap":118},[178,213,243,273],{"type":43,"tag":124,"props":179,"children":180},{"class":126,"line":127},[181,187,193,198,203,208],{"type":43,"tag":124,"props":182,"children":184},{"style":183},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[185],{"type":49,"value":186},"export",{"type":43,"tag":124,"props":188,"children":190},{"style":189},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[191],{"type":49,"value":192}," ELASTICSEARCH_URL",{"type":43,"tag":124,"props":194,"children":195},{"style":143},[196],{"type":49,"value":197},"=",{"type":43,"tag":124,"props":199,"children":200},{"style":143},[201],{"type":49,"value":202},"\"",{"type":43,"tag":124,"props":204,"children":205},{"style":137},[206],{"type":49,"value":207},"https:\u002F\u002Fyour-cluster.es.cloud.example.com:443",{"type":43,"tag":124,"props":209,"children":210},{"style":143},[211],{"type":49,"value":212},"\"\n",{"type":43,"tag":124,"props":214,"children":216},{"class":126,"line":215},2,[217,221,226,230,234,239],{"type":43,"tag":124,"props":218,"children":219},{"style":183},[220],{"type":49,"value":186},{"type":43,"tag":124,"props":222,"children":223},{"style":189},[224],{"type":49,"value":225}," ELASTICSEARCH_API_KEY",{"type":43,"tag":124,"props":227,"children":228},{"style":143},[229],{"type":49,"value":197},{"type":43,"tag":124,"props":231,"children":232},{"style":143},[233],{"type":49,"value":202},{"type":43,"tag":124,"props":235,"children":236},{"style":137},[237],{"type":49,"value":238},"your-api-key",{"type":43,"tag":124,"props":240,"children":241},{"style":143},[242],{"type":49,"value":212},{"type":43,"tag":124,"props":244,"children":246},{"class":126,"line":245},3,[247,251,256,260,264,269],{"type":43,"tag":124,"props":248,"children":249},{"style":183},[250],{"type":49,"value":186},{"type":43,"tag":124,"props":252,"children":253},{"style":189},[254],{"type":49,"value":255}," KIBANA_URL",{"type":43,"tag":124,"props":257,"children":258},{"style":143},[259],{"type":49,"value":197},{"type":43,"tag":124,"props":261,"children":262},{"style":143},[263],{"type":49,"value":202},{"type":43,"tag":124,"props":265,"children":266},{"style":137},[267],{"type":49,"value":268},"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443",{"type":43,"tag":124,"props":270,"children":271},{"style":143},[272],{"type":49,"value":212},{"type":43,"tag":124,"props":274,"children":276},{"class":126,"line":275},4,[277,281,286,290,294,299],{"type":43,"tag":124,"props":278,"children":279},{"style":183},[280],{"type":49,"value":186},{"type":43,"tag":124,"props":282,"children":283},{"style":189},[284],{"type":49,"value":285}," KIBANA_API_KEY",{"type":43,"tag":124,"props":287,"children":288},{"style":143},[289],{"type":49,"value":197},{"type":43,"tag":124,"props":291,"children":292},{"style":143},[293],{"type":49,"value":202},{"type":43,"tag":124,"props":295,"children":296},{"style":137},[297],{"type":49,"value":298},"your-kibana-api-key",{"type":43,"tag":124,"props":300,"children":301},{"style":143},[302],{"type":49,"value":212},{"type":43,"tag":67,"props":304,"children":306},{"id":305},"common-multi-step-workflows",[307],{"type":49,"value":308},"Common multi-step workflows",{"type":43,"tag":310,"props":311,"children":312},"table",{},[313,332],{"type":43,"tag":314,"props":315,"children":316},"thead",{},[317],{"type":43,"tag":318,"props":319,"children":320},"tr",{},[321,327],{"type":43,"tag":322,"props":323,"children":324},"th",{},[325],{"type":49,"value":326},"Task",{"type":43,"tag":322,"props":328,"children":329},{},[330],{"type":49,"value":331},"Tools to call (in order)",{"type":43,"tag":333,"props":334,"children":335},"tbody",{},[336,375,405,433],{"type":43,"tag":318,"props":337,"children":338},{},[339,349],{"type":43,"tag":340,"props":341,"children":342},"td",{},[343],{"type":43,"tag":344,"props":345,"children":346},"strong",{},[347],{"type":49,"value":348},"Tune noisy SIEM rule",{"type":43,"tag":340,"props":350,"children":351},{},[352,358,360,366,368,373],{"type":43,"tag":58,"props":353,"children":355},{"className":354},[],[356],{"type":49,"value":357},"rule_manager",{"type":49,"value":359}," find\u002Fnoisy-rules → ",{"type":43,"tag":58,"props":361,"children":363},{"className":362},[],[364],{"type":49,"value":365},"run_query",{"type":49,"value":367}," (investigate FPs) → ",{"type":43,"tag":58,"props":369,"children":371},{"className":370},[],[372],{"type":49,"value":357},{"type":49,"value":374}," patch or add-exception",{"type":43,"tag":318,"props":376,"children":377},{},[378,386],{"type":43,"tag":340,"props":379,"children":380},{},[381],{"type":43,"tag":344,"props":382,"children":383},{},[384],{"type":49,"value":385},"Add endpoint behavior exception",{"type":43,"tag":340,"props":387,"children":388},{},[389,395,397,403],{"type":43,"tag":58,"props":390,"children":392},{"className":391},[],[393],{"type":49,"value":394},"fetch_endpoint_rule",{"type":49,"value":396}," (get rule definition from GitHub) → ",{"type":43,"tag":58,"props":398,"children":400},{"className":399},[],[401],{"type":49,"value":402},"add_endpoint_exception",{"type":49,"value":404}," (scoped to rule.id)",{"type":43,"tag":318,"props":406,"children":407},{},[408,416],{"type":43,"tag":340,"props":409,"children":410},{},[411],{"type":43,"tag":344,"props":412,"children":413},{},[414],{"type":49,"value":415},"Create new detection rule",{"type":43,"tag":340,"props":417,"children":418},{},[419,424,426,431],{"type":43,"tag":58,"props":420,"children":422},{"className":421},[],[423],{"type":49,"value":365},{"type":49,"value":425}," (test query against data) → ",{"type":43,"tag":58,"props":427,"children":429},{"className":428},[],[430],{"type":49,"value":357},{"type":49,"value":432}," create",{"type":43,"tag":318,"props":434,"children":435},{},[436,444],{"type":43,"tag":340,"props":437,"children":438},{},[439],{"type":43,"tag":344,"props":440,"children":441},{},[442],{"type":49,"value":443},"Investigate rule alert volume",{"type":43,"tag":340,"props":445,"children":446},{},[447,452,454,459],{"type":43,"tag":58,"props":448,"children":450},{"className":449},[],[451],{"type":49,"value":357},{"type":49,"value":453}," get → ",{"type":43,"tag":58,"props":455,"children":457},{"className":456},[],[458],{"type":49,"value":365},{"type":49,"value":460}," (query alerts index)",{"type":43,"tag":52,"props":462,"children":463},{},[464,466,471],{"type":49,"value":465},"For endpoint behavior rules, always fetch the rule definition first to understand query logic and existing exclusions\nbefore adding an exception. For SIEM rules, always investigate alert patterns with ",{"type":43,"tag":58,"props":467,"children":469},{"className":468},[],[470],{"type":49,"value":365},{"type":49,"value":472}," before tuning.",{"type":43,"tag":52,"props":474,"children":475},{},[476,481,483,488,490,496,498,503],{"type":43,"tag":344,"props":477,"children":478},{},[479],{"type":49,"value":480},"Critical:",{"type":49,"value":482}," For endpoint behavior rules, always use ",{"type":43,"tag":58,"props":484,"children":486},{"className":485},[],[487],{"type":49,"value":394},{"type":49,"value":489}," (not ",{"type":43,"tag":58,"props":491,"children":493},{"className":492},[],[494],{"type":49,"value":495},"shell",{"type":49,"value":497}," or direct script calls) to get\nthe rule definition, then use ",{"type":43,"tag":58,"props":499,"children":501},{"className":500},[],[502],{"type":49,"value":402},{"type":49,"value":504}," to add the exception. These are dedicated tools — do not invoke\nthe underlying scripts manually.",{"type":43,"tag":67,"props":506,"children":508},{"id":507},"workflow-tune-a-rule-for-false-positives",[509],{"type":49,"value":510},"Workflow: Tune a rule for false positives",{"type":43,"tag":512,"props":513,"children":515},"h3",{"id":514},"steps-12-identify-noisy-rules-and-analyze-false-positives",[516],{"type":49,"value":517},"Steps 1–2: Identify noisy rules and analyze false positives",{"type":43,"tag":52,"props":519,"children":520},{},[521,523,529,531,537],{"type":49,"value":522},"Find noisy rules with ",{"type":43,"tag":58,"props":524,"children":526},{"className":525},[],[527],{"type":49,"value":528},"noisy-rules",{"type":49,"value":530}," or ",{"type":43,"tag":58,"props":532,"children":534},{"className":533},[],[535],{"type":49,"value":536},"find",{"type":49,"value":538},", then get the rule definition and investigate alerts:",{"type":43,"tag":113,"props":540,"children":542},{"className":115,"code":541,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js noisy-rules --days 7 --top 20\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js find --filter \"alert.attributes.name:*Suspicious*\" --brief\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js get --id \u003Crule_uuid>\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"kibana.alert.rule.name:\\\"\u003Crule_name>\\\"\" --index \".alerts-security.alerts-*\" --days 7 --full\n",[543],{"type":43,"tag":58,"props":544,"children":545},{"__ignoreMap":118},[546,585,625,666],{"type":43,"tag":124,"props":547,"children":548},{"class":126,"line":127},[549,554,559,564,569,575,580],{"type":43,"tag":124,"props":550,"children":551},{"style":149},[552],{"type":49,"value":553},"node",{"type":43,"tag":124,"props":555,"children":556},{"style":137},[557],{"type":49,"value":558}," skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js",{"type":43,"tag":124,"props":560,"children":561},{"style":137},[562],{"type":49,"value":563}," noisy-rules",{"type":43,"tag":124,"props":565,"children":566},{"style":137},[567],{"type":49,"value":568}," --days",{"type":43,"tag":124,"props":570,"children":572},{"style":571},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[573],{"type":49,"value":574}," 7",{"type":43,"tag":124,"props":576,"children":577},{"style":137},[578],{"type":49,"value":579}," --top",{"type":43,"tag":124,"props":581,"children":582},{"style":571},[583],{"type":49,"value":584}," 20\n",{"type":43,"tag":124,"props":586,"children":587},{"class":126,"line":215},[588,592,596,601,606,611,616,620],{"type":43,"tag":124,"props":589,"children":590},{"style":149},[591],{"type":49,"value":553},{"type":43,"tag":124,"props":593,"children":594},{"style":137},[595],{"type":49,"value":558},{"type":43,"tag":124,"props":597,"children":598},{"style":137},[599],{"type":49,"value":600}," find",{"type":43,"tag":124,"props":602,"children":603},{"style":137},[604],{"type":49,"value":605}," --filter",{"type":43,"tag":124,"props":607,"children":608},{"style":143},[609],{"type":49,"value":610}," \"",{"type":43,"tag":124,"props":612,"children":613},{"style":137},[614],{"type":49,"value":615},"alert.attributes.name:*Suspicious*",{"type":43,"tag":124,"props":617,"children":618},{"style":143},[619],{"type":49,"value":202},{"type":43,"tag":124,"props":621,"children":622},{"style":137},[623],{"type":49,"value":624}," --brief\n",{"type":43,"tag":124,"props":626,"children":627},{"class":126,"line":245},[628,632,636,641,646,651,656,661],{"type":43,"tag":124,"props":629,"children":630},{"style":149},[631],{"type":49,"value":553},{"type":43,"tag":124,"props":633,"children":634},{"style":137},[635],{"type":49,"value":558},{"type":43,"tag":124,"props":637,"children":638},{"style":137},[639],{"type":49,"value":640}," get",{"type":43,"tag":124,"props":642,"children":643},{"style":137},[644],{"type":49,"value":645}," --id",{"type":43,"tag":124,"props":647,"children":648},{"style":143},[649],{"type":49,"value":650}," \u003C",{"type":43,"tag":124,"props":652,"children":653},{"style":137},[654],{"type":49,"value":655},"rule_uui",{"type":43,"tag":124,"props":657,"children":658},{"style":189},[659],{"type":49,"value":660},"d",{"type":43,"tag":124,"props":662,"children":663},{"style":143},[664],{"type":49,"value":665},">\n",{"type":43,"tag":124,"props":667,"children":668},{"class":126,"line":275},[669,673,678,682,687,692,697,701,705,710,714,719,723,727,731],{"type":43,"tag":124,"props":670,"children":671},{"style":149},[672],{"type":49,"value":553},{"type":43,"tag":124,"props":674,"children":675},{"style":137},[676],{"type":49,"value":677}," skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js",{"type":43,"tag":124,"props":679,"children":680},{"style":143},[681],{"type":49,"value":610},{"type":43,"tag":124,"props":683,"children":684},{"style":137},[685],{"type":49,"value":686},"kibana.alert.rule.name:",{"type":43,"tag":124,"props":688,"children":689},{"style":189},[690],{"type":49,"value":691},"\\\"",{"type":43,"tag":124,"props":693,"children":694},{"style":137},[695],{"type":49,"value":696},"\u003Crule_name>",{"type":43,"tag":124,"props":698,"children":699},{"style":189},[700],{"type":49,"value":691},{"type":43,"tag":124,"props":702,"children":703},{"style":143},[704],{"type":49,"value":202},{"type":43,"tag":124,"props":706,"children":707},{"style":137},[708],{"type":49,"value":709}," --index",{"type":43,"tag":124,"props":711,"children":712},{"style":143},[713],{"type":49,"value":610},{"type":43,"tag":124,"props":715,"children":716},{"style":137},[717],{"type":49,"value":718},".alerts-security.alerts-*",{"type":43,"tag":124,"props":720,"children":721},{"style":143},[722],{"type":49,"value":202},{"type":43,"tag":124,"props":724,"children":725},{"style":137},[726],{"type":49,"value":568},{"type":43,"tag":124,"props":728,"children":729},{"style":571},[730],{"type":49,"value":574},{"type":43,"tag":124,"props":732,"children":733},{"style":137},[734],{"type":49,"value":735}," --full\n",{"type":43,"tag":52,"props":737,"children":738},{},[739],{"type":49,"value":740},"Look for patterns: same process\u002Fuser\u002Fhost → exception candidate; broad pattern → tighten query; legitimate software →\nexception; too broad → rewrite or adjust threshold.",{"type":43,"tag":512,"props":742,"children":744},{"id":743},"step-3-choose-a-tuning-strategy",[745],{"type":49,"value":746},"Step 3: Choose a tuning strategy",{"type":43,"tag":52,"props":748,"children":749},{},[750],{"type":43,"tag":344,"props":751,"children":752},{},[753],{"type":49,"value":754},"In order of preference:",{"type":43,"tag":756,"props":757,"children":758},"ol",{},[759,769,779,789,799],{"type":43,"tag":78,"props":760,"children":761},{},[762,767],{"type":43,"tag":344,"props":763,"children":764},{},[765],{"type":49,"value":766},"Add exception",{"type":49,"value":768}," — Best for specific known-good processes, users, or hosts. Does not modify the rule query. Use when\nthe rule is correct in general but fires on known-legitimate activity.",{"type":43,"tag":78,"props":770,"children":771},{},[772,777],{"type":43,"tag":344,"props":773,"children":774},{},[775],{"type":49,"value":776},"Tighten the query",{"type":49,"value":778}," — Patch the rule's query to exclude the FP pattern. Best when the false positives stem from the\nquery being too broad.",{"type":43,"tag":78,"props":780,"children":781},{},[782,787],{"type":43,"tag":344,"props":783,"children":784},{},[785],{"type":49,"value":786},"Adjust threshold \u002F alert suppression",{"type":49,"value":788}," — For threshold rules, increase the threshold value. For any rule type,\nenable alert suppression to reduce duplicate alerts on the same entity.",{"type":43,"tag":78,"props":790,"children":791},{},[792,797],{"type":43,"tag":344,"props":793,"children":794},{},[795],{"type":49,"value":796},"Reduce risk score \u002F severity",{"type":49,"value":798}," — Downgrade the rule's priority if it generates many low-value alerts but still has\nsome detection value.",{"type":43,"tag":78,"props":800,"children":801},{},[802,807],{"type":43,"tag":344,"props":803,"children":804},{},[805],{"type":49,"value":806},"Disable the rule",{"type":49,"value":808}," — Last resort. Only if the rule provides no value or is completely redundant with another rule.",{"type":43,"tag":512,"props":810,"children":812},{"id":811},"steps-45-apply-tuning-verify-and-document",[813],{"type":49,"value":814},"Steps 4–5: Apply tuning, verify, and document",{"type":43,"tag":52,"props":816,"children":817},{},[818,822,824,830],{"type":43,"tag":344,"props":819,"children":820},{},[821],{"type":49,"value":766},{"type":49,"value":823}," (single\u002Fmulti-condition, wildcard via ",{"type":43,"tag":58,"props":825,"children":827},{"className":826},[],[828],{"type":49,"value":829},"matches",{"type":49,"value":831},"):",{"type":43,"tag":113,"props":833,"children":835},{"className":115,"code":834,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js add-exception \\\n  --rule-uuid \u003Crule_uuid> \\\n  --entries \"process.executable:is:C:\\\\Program Files\\\\SCCM\\\\CcmExec.exe\" \"process.parent.name:is:CcmExec.exe\" \\\n  --name \"Exclude SCCM\" --comment \"FP: SCCM deployment\" --tags \"tuning:fp\" \"source:soc\" --yes\n",[836],{"type":43,"tag":58,"props":837,"children":838},{"__ignoreMap":118},[839,860,889,955],{"type":43,"tag":124,"props":840,"children":841},{"class":126,"line":127},[842,846,850,855],{"type":43,"tag":124,"props":843,"children":844},{"style":149},[845],{"type":49,"value":553},{"type":43,"tag":124,"props":847,"children":848},{"style":137},[849],{"type":49,"value":558},{"type":43,"tag":124,"props":851,"children":852},{"style":137},[853],{"type":49,"value":854}," add-exception",{"type":43,"tag":124,"props":856,"children":857},{"style":189},[858],{"type":49,"value":859}," \\\n",{"type":43,"tag":124,"props":861,"children":862},{"class":126,"line":215},[863,868,872,876,880,885],{"type":43,"tag":124,"props":864,"children":865},{"style":137},[866],{"type":49,"value":867},"  --rule-uuid",{"type":43,"tag":124,"props":869,"children":870},{"style":143},[871],{"type":49,"value":650},{"type":43,"tag":124,"props":873,"children":874},{"style":137},[875],{"type":49,"value":655},{"type":43,"tag":124,"props":877,"children":878},{"style":189},[879],{"type":49,"value":660},{"type":43,"tag":124,"props":881,"children":882},{"style":143},[883],{"type":49,"value":884},">",{"type":43,"tag":124,"props":886,"children":887},{"style":189},[888],{"type":49,"value":859},{"type":43,"tag":124,"props":890,"children":891},{"class":126,"line":245},[892,897,901,906,911,916,920,925,929,934,938,942,947,951],{"type":43,"tag":124,"props":893,"children":894},{"style":137},[895],{"type":49,"value":896},"  --entries",{"type":43,"tag":124,"props":898,"children":899},{"style":143},[900],{"type":49,"value":610},{"type":43,"tag":124,"props":902,"children":903},{"style":137},[904],{"type":49,"value":905},"process.executable:is:C:",{"type":43,"tag":124,"props":907,"children":908},{"style":189},[909],{"type":49,"value":910},"\\\\",{"type":43,"tag":124,"props":912,"children":913},{"style":137},[914],{"type":49,"value":915},"Program Files",{"type":43,"tag":124,"props":917,"children":918},{"style":189},[919],{"type":49,"value":910},{"type":43,"tag":124,"props":921,"children":922},{"style":137},[923],{"type":49,"value":924},"SCCM",{"type":43,"tag":124,"props":926,"children":927},{"style":189},[928],{"type":49,"value":910},{"type":43,"tag":124,"props":930,"children":931},{"style":137},[932],{"type":49,"value":933},"CcmExec.exe",{"type":43,"tag":124,"props":935,"children":936},{"style":143},[937],{"type":49,"value":202},{"type":43,"tag":124,"props":939,"children":940},{"style":143},[941],{"type":49,"value":610},{"type":43,"tag":124,"props":943,"children":944},{"style":137},[945],{"type":49,"value":946},"process.parent.name:is:CcmExec.exe",{"type":43,"tag":124,"props":948,"children":949},{"style":143},[950],{"type":49,"value":202},{"type":43,"tag":124,"props":952,"children":953},{"style":189},[954],{"type":49,"value":859},{"type":43,"tag":124,"props":956,"children":957},{"class":126,"line":275},[958,963,967,972,976,981,985,990,994,999,1003,1008,1012,1016,1021,1025],{"type":43,"tag":124,"props":959,"children":960},{"style":137},[961],{"type":49,"value":962},"  --name",{"type":43,"tag":124,"props":964,"children":965},{"style":143},[966],{"type":49,"value":610},{"type":43,"tag":124,"props":968,"children":969},{"style":137},[970],{"type":49,"value":971},"Exclude SCCM",{"type":43,"tag":124,"props":973,"children":974},{"style":143},[975],{"type":49,"value":202},{"type":43,"tag":124,"props":977,"children":978},{"style":137},[979],{"type":49,"value":980}," --comment",{"type":43,"tag":124,"props":982,"children":983},{"style":143},[984],{"type":49,"value":610},{"type":43,"tag":124,"props":986,"children":987},{"style":137},[988],{"type":49,"value":989},"FP: SCCM deployment",{"type":43,"tag":124,"props":991,"children":992},{"style":143},[993],{"type":49,"value":202},{"type":43,"tag":124,"props":995,"children":996},{"style":137},[997],{"type":49,"value":998}," --tags",{"type":43,"tag":124,"props":1000,"children":1001},{"style":143},[1002],{"type":49,"value":610},{"type":43,"tag":124,"props":1004,"children":1005},{"style":137},[1006],{"type":49,"value":1007},"tuning:fp",{"type":43,"tag":124,"props":1009,"children":1010},{"style":143},[1011],{"type":49,"value":202},{"type":43,"tag":124,"props":1013,"children":1014},{"style":143},[1015],{"type":49,"value":610},{"type":43,"tag":124,"props":1017,"children":1018},{"style":137},[1019],{"type":49,"value":1020},"source:soc",{"type":43,"tag":124,"props":1022,"children":1023},{"style":143},[1024],{"type":49,"value":202},{"type":43,"tag":124,"props":1026,"children":1027},{"style":137},[1028],{"type":49,"value":1029}," --yes\n",{"type":43,"tag":52,"props":1031,"children":1032},{},[1033],{"type":43,"tag":344,"props":1034,"children":1035},{},[1036],{"type":49,"value":1037},"Patch query, threshold, severity, or disable:",{"type":43,"tag":113,"props":1039,"children":1041},{"className":115,"code":1040,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js patch --id \u003Crule_uuid> --query \"process.name:powershell.exe AND NOT process.parent.name:CcmExec.exe\" --yes\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js patch --id \u003Crule_uuid> --max-signals 50 --yes\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js patch --id \u003Crule_uuid> --severity low --risk-score 21 --yes\nnode skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js disable --id \u003Crule_uuid> --yes\n",[1042],{"type":43,"tag":58,"props":1043,"children":1044},{"__ignoreMap":118},[1045,1103,1152,1211],{"type":43,"tag":124,"props":1046,"children":1047},{"class":126,"line":127},[1048,1052,1056,1061,1065,1069,1073,1077,1081,1086,1090,1095,1099],{"type":43,"tag":124,"props":1049,"children":1050},{"style":149},[1051],{"type":49,"value":553},{"type":43,"tag":124,"props":1053,"children":1054},{"style":137},[1055],{"type":49,"value":558},{"type":43,"tag":124,"props":1057,"children":1058},{"style":137},[1059],{"type":49,"value":1060}," patch",{"type":43,"tag":124,"props":1062,"children":1063},{"style":137},[1064],{"type":49,"value":645},{"type":43,"tag":124,"props":1066,"children":1067},{"style":143},[1068],{"type":49,"value":650},{"type":43,"tag":124,"props":1070,"children":1071},{"style":137},[1072],{"type":49,"value":655},{"type":43,"tag":124,"props":1074,"children":1075},{"style":189},[1076],{"type":49,"value":660},{"type":43,"tag":124,"props":1078,"children":1079},{"style":143},[1080],{"type":49,"value":884},{"type":43,"tag":124,"props":1082,"children":1083},{"style":137},[1084],{"type":49,"value":1085}," --query",{"type":43,"tag":124,"props":1087,"children":1088},{"style":143},[1089],{"type":49,"value":610},{"type":43,"tag":124,"props":1091,"children":1092},{"style":137},[1093],{"type":49,"value":1094},"process.name:powershell.exe AND NOT process.parent.name:CcmExec.exe",{"type":43,"tag":124,"props":1096,"children":1097},{"style":143},[1098],{"type":49,"value":202},{"type":43,"tag":124,"props":1100,"children":1101},{"style":137},[1102],{"type":49,"value":1029},{"type":43,"tag":124,"props":1104,"children":1105},{"class":126,"line":215},[1106,1110,1114,1118,1122,1126,1130,1134,1138,1143,1148],{"type":43,"tag":124,"props":1107,"children":1108},{"style":149},[1109],{"type":49,"value":553},{"type":43,"tag":124,"props":1111,"children":1112},{"style":137},[1113],{"type":49,"value":558},{"type":43,"tag":124,"props":1115,"children":1116},{"style":137},[1117],{"type":49,"value":1060},{"type":43,"tag":124,"props":1119,"children":1120},{"style":137},[1121],{"type":49,"value":645},{"type":43,"tag":124,"props":1123,"children":1124},{"style":143},[1125],{"type":49,"value":650},{"type":43,"tag":124,"props":1127,"children":1128},{"style":137},[1129],{"type":49,"value":655},{"type":43,"tag":124,"props":1131,"children":1132},{"style":189},[1133],{"type":49,"value":660},{"type":43,"tag":124,"props":1135,"children":1136},{"style":143},[1137],{"type":49,"value":884},{"type":43,"tag":124,"props":1139,"children":1140},{"style":137},[1141],{"type":49,"value":1142}," --max-signals",{"type":43,"tag":124,"props":1144,"children":1145},{"style":571},[1146],{"type":49,"value":1147}," 50",{"type":43,"tag":124,"props":1149,"children":1150},{"style":137},[1151],{"type":49,"value":1029},{"type":43,"tag":124,"props":1153,"children":1154},{"class":126,"line":245},[1155,1159,1163,1167,1171,1175,1179,1183,1187,1192,1197,1202,1207],{"type":43,"tag":124,"props":1156,"children":1157},{"style":149},[1158],{"type":49,"value":553},{"type":43,"tag":124,"props":1160,"children":1161},{"style":137},[1162],{"type":49,"value":558},{"type":43,"tag":124,"props":1164,"children":1165},{"style":137},[1166],{"type":49,"value":1060},{"type":43,"tag":124,"props":1168,"children":1169},{"style":137},[1170],{"type":49,"value":645},{"type":43,"tag":124,"props":1172,"children":1173},{"style":143},[1174],{"type":49,"value":650},{"type":43,"tag":124,"props":1176,"children":1177},{"style":137},[1178],{"type":49,"value":655},{"type":43,"tag":124,"props":1180,"children":1181},{"style":189},[1182],{"type":49,"value":660},{"type":43,"tag":124,"props":1184,"children":1185},{"style":143},[1186],{"type":49,"value":884},{"type":43,"tag":124,"props":1188,"children":1189},{"style":137},[1190],{"type":49,"value":1191}," --severity",{"type":43,"tag":124,"props":1193,"children":1194},{"style":137},[1195],{"type":49,"value":1196}," low",{"type":43,"tag":124,"props":1198,"children":1199},{"style":137},[1200],{"type":49,"value":1201}," --risk-score",{"type":43,"tag":124,"props":1203,"children":1204},{"style":571},[1205],{"type":49,"value":1206}," 21",{"type":43,"tag":124,"props":1208,"children":1209},{"style":137},[1210],{"type":49,"value":1029},{"type":43,"tag":124,"props":1212,"children":1213},{"class":126,"line":275},[1214,1218,1222,1227,1231,1235,1239,1243,1247],{"type":43,"tag":124,"props":1215,"children":1216},{"style":149},[1217],{"type":49,"value":553},{"type":43,"tag":124,"props":1219,"children":1220},{"style":137},[1221],{"type":49,"value":558},{"type":43,"tag":124,"props":1223,"children":1224},{"style":137},[1225],{"type":49,"value":1226}," disable",{"type":43,"tag":124,"props":1228,"children":1229},{"style":137},[1230],{"type":49,"value":645},{"type":43,"tag":124,"props":1232,"children":1233},{"style":143},[1234],{"type":49,"value":650},{"type":43,"tag":124,"props":1236,"children":1237},{"style":137},[1238],{"type":49,"value":655},{"type":43,"tag":124,"props":1240,"children":1241},{"style":189},[1242],{"type":49,"value":660},{"type":43,"tag":124,"props":1244,"children":1245},{"style":143},[1246],{"type":49,"value":884},{"type":43,"tag":124,"props":1248,"children":1249},{"style":137},[1250],{"type":49,"value":1029},{"type":43,"tag":52,"props":1252,"children":1253},{},[1254,1256,1262,1264,1270,1271,1277,1278,1284,1285,1291,1292,1298,1300,1306],{"type":49,"value":1255},"Write operations (",{"type":43,"tag":58,"props":1257,"children":1259},{"className":1258},[],[1260],{"type":49,"value":1261},"patch",{"type":49,"value":1263},", ",{"type":43,"tag":58,"props":1265,"children":1267},{"className":1266},[],[1268],{"type":49,"value":1269},"enable",{"type":49,"value":1263},{"type":43,"tag":58,"props":1272,"children":1274},{"className":1273},[],[1275],{"type":49,"value":1276},"disable",{"type":49,"value":1263},{"type":43,"tag":58,"props":1279,"children":1281},{"className":1280},[],[1282],{"type":49,"value":1283},"delete",{"type":49,"value":1263},{"type":43,"tag":58,"props":1286,"children":1288},{"className":1287},[],[1289],{"type":49,"value":1290},"add-exception",{"type":49,"value":1263},{"type":43,"tag":58,"props":1293,"children":1295},{"className":1294},[],[1296],{"type":49,"value":1297},"bulk-action",{"type":49,"value":1299},") prompt for confirmation by\ndefault. Pass ",{"type":43,"tag":58,"props":1301,"children":1303},{"className":1302},[],[1304],{"type":49,"value":1305},"--yes",{"type":49,"value":1307}," to skip the prompt (required when called by an agent).",{"type":43,"tag":52,"props":1309,"children":1310},{},[1311,1313,1319,1321,1327],{"type":49,"value":1312},"Verify with ",{"type":43,"tag":58,"props":1314,"children":1316},{"className":1315},[],[1317],{"type":49,"value":1318},"rule-manager.js get --id \u003Crule_uuid>",{"type":49,"value":1320},". Update triage cases via the ",{"type":43,"tag":58,"props":1322,"children":1324},{"className":1323},[],[1325],{"type":49,"value":1326},"case-management",{"type":49,"value":1328}," skill.",{"type":43,"tag":1330,"props":1331,"children":1332},"hr",{},[],{"type":43,"tag":67,"props":1334,"children":1336},{"id":1335},"workflow-create-new-detection-rule",[1337],{"type":49,"value":1338},"Workflow: Create new detection rule",{"type":43,"tag":512,"props":1340,"children":1342},{"id":1341},"steps-12-define-the-threat-data-sources-and-fields",[1343],{"type":49,"value":1344},"Steps 1–2: Define the threat, data sources, and fields",{"type":43,"tag":52,"props":1346,"children":1347},{},[1348,1350,1356,1357,1363,1365,1370,1371,1377,1378,1384,1386,1392,1393,1399,1400,1406,1407,1413,1414,1420,1421,1427,1429,1435],{"type":49,"value":1349},"Specify MITRE ATT&CK technique(s), required data sources (Endpoint, Network, Cloud), and malicious vs legitimate\nbehavior. Common indexes: ",{"type":43,"tag":58,"props":1351,"children":1353},{"className":1352},[],[1354],{"type":49,"value":1355},"logs-endpoint.events.process-*",{"type":49,"value":1263},{"type":43,"tag":58,"props":1358,"children":1360},{"className":1359},[],[1361],{"type":49,"value":1362},"logs-endpoint.events.network-*",{"type":49,"value":1364},",\n",{"type":43,"tag":58,"props":1366,"children":1368},{"className":1367},[],[1369],{"type":49,"value":718},{"type":49,"value":1263},{"type":43,"tag":58,"props":1372,"children":1374},{"className":1373},[],[1375],{"type":49,"value":1376},"logs-windows.*",{"type":49,"value":1263},{"type":43,"tag":58,"props":1379,"children":1381},{"className":1380},[],[1382],{"type":49,"value":1383},"logs-aws.*",{"type":49,"value":1385},". Key fields: ",{"type":43,"tag":58,"props":1387,"children":1389},{"className":1388},[],[1390],{"type":49,"value":1391},"process.name",{"type":49,"value":1263},{"type":43,"tag":58,"props":1394,"children":1396},{"className":1395},[],[1397],{"type":49,"value":1398},"process.command_line",{"type":49,"value":1364},{"type":43,"tag":58,"props":1401,"children":1403},{"className":1402},[],[1404],{"type":49,"value":1405},"process.parent.name",{"type":49,"value":1263},{"type":43,"tag":58,"props":1408,"children":1410},{"className":1409},[],[1411],{"type":49,"value":1412},"destination.ip",{"type":49,"value":1263},{"type":43,"tag":58,"props":1415,"children":1417},{"className":1416},[],[1418],{"type":49,"value":1419},"winlog.event_id",{"type":49,"value":1263},{"type":43,"tag":58,"props":1422,"children":1424},{"className":1423},[],[1425],{"type":49,"value":1426},"event.action",{"type":49,"value":1428},". Verify data with ",{"type":43,"tag":58,"props":1430,"children":1432},{"className":1431},[],[1433],{"type":49,"value":1434},"run-query.js",{"type":49,"value":1436},":",{"type":43,"tag":113,"props":1438,"children":1440},{"className":115,"code":1439,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"process.name:certutil.exe\" --index \"logs-endpoint.events.process-*\" --days 30 --size 5\n",[1441],{"type":43,"tag":58,"props":1442,"children":1443},{"__ignoreMap":118},[1444],{"type":43,"tag":124,"props":1445,"children":1446},{"class":126,"line":127},[1447,1451,1455,1459,1464,1468,1472,1476,1480,1484,1488,1493,1498],{"type":43,"tag":124,"props":1448,"children":1449},{"style":149},[1450],{"type":49,"value":553},{"type":43,"tag":124,"props":1452,"children":1453},{"style":137},[1454],{"type":49,"value":677},{"type":43,"tag":124,"props":1456,"children":1457},{"style":143},[1458],{"type":49,"value":610},{"type":43,"tag":124,"props":1460,"children":1461},{"style":137},[1462],{"type":49,"value":1463},"process.name:certutil.exe",{"type":43,"tag":124,"props":1465,"children":1466},{"style":143},[1467],{"type":49,"value":202},{"type":43,"tag":124,"props":1469,"children":1470},{"style":137},[1471],{"type":49,"value":709},{"type":43,"tag":124,"props":1473,"children":1474},{"style":143},[1475],{"type":49,"value":610},{"type":43,"tag":124,"props":1477,"children":1478},{"style":137},[1479],{"type":49,"value":1355},{"type":43,"tag":124,"props":1481,"children":1482},{"style":143},[1483],{"type":49,"value":202},{"type":43,"tag":124,"props":1485,"children":1486},{"style":137},[1487],{"type":49,"value":568},{"type":43,"tag":124,"props":1489,"children":1490},{"style":571},[1491],{"type":49,"value":1492}," 30",{"type":43,"tag":124,"props":1494,"children":1495},{"style":137},[1496],{"type":49,"value":1497}," --size",{"type":43,"tag":124,"props":1499,"children":1500},{"style":571},[1501],{"type":49,"value":1502}," 5\n",{"type":43,"tag":512,"props":1504,"children":1506},{"id":1505},"step-3-write-and-test-the-query",[1507],{"type":49,"value":1508},"Step 3: Write and test the query",{"type":43,"tag":52,"props":1510,"children":1511},{},[1512,1514,1520,1522,1528,1530,1536,1538,1544,1546,1552,1554,1560],{"type":49,"value":1513},"Rule types: ",{"type":43,"tag":58,"props":1515,"children":1517},{"className":1516},[],[1518],{"type":49,"value":1519},"query",{"type":49,"value":1521}," (KQL field matching), ",{"type":43,"tag":58,"props":1523,"children":1525},{"className":1524},[],[1526],{"type":49,"value":1527},"eql",{"type":49,"value":1529}," (event sequences), ",{"type":43,"tag":58,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":49,"value":1535},"esql",{"type":49,"value":1537}," (aggregations), ",{"type":43,"tag":58,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":49,"value":1543},"threshold",{"type":49,"value":1545}," (volume-based),\n",{"type":43,"tag":58,"props":1547,"children":1549},{"className":1548},[],[1550],{"type":49,"value":1551},"threat_match",{"type":49,"value":1553}," (IOC correlation), ",{"type":43,"tag":58,"props":1555,"children":1557},{"className":1556},[],[1558],{"type":49,"value":1559},"new_terms",{"type":49,"value":1561}," (first-seen). Test against Elasticsearch before creating:",{"type":43,"tag":113,"props":1563,"children":1565},{"className":115,"code":1564,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)\" \\\n  --index \"logs-endpoint.events.process-*\" --days 30\n",[1566],{"type":43,"tag":58,"props":1567,"children":1568},{"__ignoreMap":118},[1569,1597],{"type":43,"tag":124,"props":1570,"children":1571},{"class":126,"line":127},[1572,1576,1580,1584,1589,1593],{"type":43,"tag":124,"props":1573,"children":1574},{"style":149},[1575],{"type":49,"value":553},{"type":43,"tag":124,"props":1577,"children":1578},{"style":137},[1579],{"type":49,"value":677},{"type":43,"tag":124,"props":1581,"children":1582},{"style":143},[1583],{"type":49,"value":610},{"type":43,"tag":124,"props":1585,"children":1586},{"style":137},[1587],{"type":49,"value":1588},"process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)",{"type":43,"tag":124,"props":1590,"children":1591},{"style":143},[1592],{"type":49,"value":202},{"type":43,"tag":124,"props":1594,"children":1595},{"style":189},[1596],{"type":49,"value":859},{"type":43,"tag":124,"props":1598,"children":1599},{"class":126,"line":215},[1600,1605,1609,1613,1617,1621],{"type":43,"tag":124,"props":1601,"children":1602},{"style":137},[1603],{"type":49,"value":1604},"  --index",{"type":43,"tag":124,"props":1606,"children":1607},{"style":143},[1608],{"type":49,"value":610},{"type":43,"tag":124,"props":1610,"children":1611},{"style":137},[1612],{"type":49,"value":1355},{"type":43,"tag":124,"props":1614,"children":1615},{"style":143},[1616],{"type":49,"value":202},{"type":43,"tag":124,"props":1618,"children":1619},{"style":137},[1620],{"type":49,"value":568},{"type":43,"tag":124,"props":1622,"children":1623},{"style":571},[1624],{"type":49,"value":1625}," 30\n",{"type":43,"tag":52,"props":1627,"children":1628},{},[1629,1631,1637],{"type":49,"value":1630},"For EQL, use ",{"type":43,"tag":58,"props":1632,"children":1634},{"className":1633},[],[1635],{"type":49,"value":1636},"--query-file",{"type":49,"value":1638}," to avoid shell escaping issues.",{"type":43,"tag":52,"props":1640,"children":1641},{},[1642,1647,1649,1655],{"type":43,"tag":344,"props":1643,"children":1644},{},[1645],{"type":49,"value":1646},"Validate query syntax before creating or patching a rule.",{"type":49,"value":1648}," The ",{"type":43,"tag":58,"props":1650,"children":1652},{"className":1651},[],[1653],{"type":49,"value":1654},"validate-query",{"type":49,"value":1656}," command catches common errors locally\n— escaped backslashes, mismatched parentheses, unbalanced quotes, and duplicate boolean operators:",{"type":43,"tag":113,"props":1658,"children":1660},{"className":115,"code":1659,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js validate-query \\\n  --query \"process.name:taskkill.exe AND process.command_line:(*chrome.exe* OR *msedge.exe*)\" --language kuery\n",[1661],{"type":43,"tag":58,"props":1662,"children":1663},{"__ignoreMap":118},[1664,1684],{"type":43,"tag":124,"props":1665,"children":1666},{"class":126,"line":127},[1667,1671,1675,1680],{"type":43,"tag":124,"props":1668,"children":1669},{"style":149},[1670],{"type":49,"value":553},{"type":43,"tag":124,"props":1672,"children":1673},{"style":137},[1674],{"type":49,"value":558},{"type":43,"tag":124,"props":1676,"children":1677},{"style":137},[1678],{"type":49,"value":1679}," validate-query",{"type":43,"tag":124,"props":1681,"children":1682},{"style":189},[1683],{"type":49,"value":859},{"type":43,"tag":124,"props":1685,"children":1686},{"class":126,"line":215},[1687,1692,1696,1701,1705,1710],{"type":43,"tag":124,"props":1688,"children":1689},{"style":137},[1690],{"type":49,"value":1691},"  --query",{"type":43,"tag":124,"props":1693,"children":1694},{"style":143},[1695],{"type":49,"value":610},{"type":43,"tag":124,"props":1697,"children":1698},{"style":137},[1699],{"type":49,"value":1700},"process.name:taskkill.exe AND process.command_line:(*chrome.exe* OR *msedge.exe*)",{"type":43,"tag":124,"props":1702,"children":1703},{"style":143},[1704],{"type":49,"value":202},{"type":43,"tag":124,"props":1706,"children":1707},{"style":137},[1708],{"type":49,"value":1709}," --language",{"type":43,"tag":124,"props":1711,"children":1712},{"style":137},[1713],{"type":49,"value":1714}," kuery\n",{"type":43,"tag":52,"props":1716,"children":1717},{},[1718,1720,1726,1728,1733,1735,1741],{"type":49,"value":1719},"The ",{"type":43,"tag":58,"props":1721,"children":1723},{"className":1722},[],[1724],{"type":49,"value":1725},"create",{"type":49,"value":1727}," and ",{"type":43,"tag":58,"props":1729,"children":1731},{"className":1730},[],[1732],{"type":49,"value":1261},{"type":49,"value":1734}," commands also run validation automatically and reject invalid queries. Pass ",{"type":43,"tag":58,"props":1736,"children":1738},{"className":1737},[],[1739],{"type":49,"value":1740},"--skip-validation",{"type":49,"value":1742},"\nonly if you are certain the query is correct despite triggering a check.",{"type":43,"tag":52,"props":1744,"children":1745},{},[1746],{"type":49,"value":1747},"Common KQL syntax mistakes:",{"type":43,"tag":74,"props":1749,"children":1750},{},[1751,1776,1801,1817],{"type":43,"tag":78,"props":1752,"children":1753},{},[1754,1759,1761,1767,1769,1775],{"type":43,"tag":344,"props":1755,"children":1756},{},[1757],{"type":49,"value":1758},"Escaped forward-slashes",{"type":49,"value":1760}," — KQL wildcards use plain text. Write ",{"type":43,"tag":58,"props":1762,"children":1764},{"className":1763},[],[1765],{"type":49,"value":1766},"*\u002FIM chrome.exe*",{"type":49,"value":1768},", not ",{"type":43,"tag":58,"props":1770,"children":1772},{"className":1771},[],[1773],{"type":49,"value":1774},"*\\\u002FIM chrome.exe*",{"type":49,"value":65},{"type":43,"tag":78,"props":1777,"children":1778},{},[1779,1784,1786,1792,1794,1800],{"type":43,"tag":344,"props":1780,"children":1781},{},[1782],{"type":49,"value":1783},"Mismatched parentheses",{"type":49,"value":1785}," — every ",{"type":43,"tag":58,"props":1787,"children":1789},{"className":1788},[],[1790],{"type":49,"value":1791},"(",{"type":49,"value":1793}," must have a matching ",{"type":43,"tag":58,"props":1795,"children":1797},{"className":1796},[],[1798],{"type":49,"value":1799},")",{"type":49,"value":65},{"type":43,"tag":78,"props":1802,"children":1803},{},[1804,1809,1810,1815],{"type":43,"tag":344,"props":1805,"children":1806},{},[1807],{"type":49,"value":1808},"Unbalanced quotes",{"type":49,"value":1785},{"type":43,"tag":58,"props":1811,"children":1813},{"className":1812},[],[1814],{"type":49,"value":202},{"type":49,"value":1816}," must be paired.",{"type":43,"tag":78,"props":1818,"children":1819},{},[1820,1825,1827,1833,1834,1840],{"type":43,"tag":344,"props":1821,"children":1822},{},[1823],{"type":49,"value":1824},"Duplicate operators",{"type":49,"value":1826}," — ",{"type":43,"tag":58,"props":1828,"children":1830},{"className":1829},[],[1831],{"type":49,"value":1832},"AND AND",{"type":49,"value":530},{"type":43,"tag":58,"props":1835,"children":1837},{"className":1836},[],[1838],{"type":49,"value":1839},"OR OR",{"type":49,"value":1841}," is always an error.",{"type":43,"tag":512,"props":1843,"children":1845},{"id":1844},"step-4-create-the-rule",[1846],{"type":49,"value":1847},"Step 4: Create the rule",{"type":43,"tag":113,"props":1849,"children":1851},{"className":115,"code":1850,"language":117,"meta":118,"style":118},"node skills\u002Fsecurity\u002Fdetection-rule-management\u002Fscripts\u002Frule-manager.js create \\\n  --name \"Certutil URL Download or Decode\" \\\n  --description \"Detects certutil.exe used to download files or decode Base64 payloads, a common LOLBin technique.\" \\\n  --type query \\\n  --query \"process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)\" \\\n  --index \"logs-endpoint.events.process-*\" \\\n  --severity medium --risk-score 47 \\\n  --tags \"OS:Windows\" \"Tactic:Defense Evasion\" \"Tactic:Command and Control\" \\\n  --false-positives \"IT administrators using certutil for legitimate certificate operations\" \\\n  --references \"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1140\u002F\" \\\n  --interval 5m --disabled\n",[1852],{"type":43,"tag":58,"props":1853,"children":1854},{"__ignoreMap":118},[1855,1874,1898,1923,1940,1964,1988,2015,2067,2093,2119],{"type":43,"tag":124,"props":1856,"children":1857},{"class":126,"line":127},[1858,1862,1866,1870],{"type":43,"tag":124,"props":1859,"children":1860},{"style":149},[1861],{"type":49,"value":553},{"type":43,"tag":124,"props":1863,"children":1864},{"style":137},[1865],{"type":49,"value":558},{"type":43,"tag":124,"props":1867,"children":1868},{"style":137},[1869],{"type":49,"value":432},{"type":43,"tag":124,"props":1871,"children":1872},{"style":189},[1873],{"type":49,"value":859},{"type":43,"tag":124,"props":1875,"children":1876},{"class":126,"line":215},[1877,1881,1885,1890,1894],{"type":43,"tag":124,"props":1878,"children":1879},{"style":137},[1880],{"type":49,"value":962},{"type":43,"tag":124,"props":1882,"children":1883},{"style":143},[1884],{"type":49,"value":610},{"type":43,"tag":124,"props":1886,"children":1887},{"style":137},[1888],{"type":49,"value":1889},"Certutil URL Download or Decode",{"type":43,"tag":124,"props":1891,"children":1892},{"style":143},[1893],{"type":49,"value":202},{"type":43,"tag":124,"props":1895,"children":1896},{"style":189},[1897],{"type":49,"value":859},{"type":43,"tag":124,"props":1899,"children":1900},{"class":126,"line":245},[1901,1906,1910,1915,1919],{"type":43,"tag":124,"props":1902,"children":1903},{"style":137},[1904],{"type":49,"value":1905},"  --description",{"type":43,"tag":124,"props":1907,"children":1908},{"style":143},[1909],{"type":49,"value":610},{"type":43,"tag":124,"props":1911,"children":1912},{"style":137},[1913],{"type":49,"value":1914},"Detects certutil.exe used to download files or decode Base64 payloads, a common LOLBin technique.",{"type":43,"tag":124,"props":1916,"children":1917},{"style":143},[1918],{"type":49,"value":202},{"type":43,"tag":124,"props":1920,"children":1921},{"style":189},[1922],{"type":49,"value":859},{"type":43,"tag":124,"props":1924,"children":1925},{"class":126,"line":275},[1926,1931,1936],{"type":43,"tag":124,"props":1927,"children":1928},{"style":137},[1929],{"type":49,"value":1930},"  --type",{"type":43,"tag":124,"props":1932,"children":1933},{"style":137},[1934],{"type":49,"value":1935}," query",{"type":43,"tag":124,"props":1937,"children":1938},{"style":189},[1939],{"type":49,"value":859},{"type":43,"tag":124,"props":1941,"children":1943},{"class":126,"line":1942},5,[1944,1948,1952,1956,1960],{"type":43,"tag":124,"props":1945,"children":1946},{"style":137},[1947],{"type":49,"value":1691},{"type":43,"tag":124,"props":1949,"children":1950},{"style":143},[1951],{"type":49,"value":610},{"type":43,"tag":124,"props":1953,"children":1954},{"style":137},[1955],{"type":49,"value":1588},{"type":43,"tag":124,"props":1957,"children":1958},{"style":143},[1959],{"type":49,"value":202},{"type":43,"tag":124,"props":1961,"children":1962},{"style":189},[1963],{"type":49,"value":859},{"type":43,"tag":124,"props":1965,"children":1967},{"class":126,"line":1966},6,[1968,1972,1976,1980,1984],{"type":43,"tag":124,"props":1969,"children":1970},{"style":137},[1971],{"type":49,"value":1604},{"type":43,"tag":124,"props":1973,"children":1974},{"style":143},[1975],{"type":49,"value":610},{"type":43,"tag":124,"props":1977,"children":1978},{"style":137},[1979],{"type":49,"value":1355},{"type":43,"tag":124,"props":1981,"children":1982},{"style":143},[1983],{"type":49,"value":202},{"type":43,"tag":124,"props":1985,"children":1986},{"style":189},[1987],{"type":49,"value":859},{"type":43,"tag":124,"props":1989,"children":1991},{"class":126,"line":1990},7,[1992,1997,2002,2006,2011],{"type":43,"tag":124,"props":1993,"children":1994},{"style":137},[1995],{"type":49,"value":1996},"  --severity",{"type":43,"tag":124,"props":1998,"children":1999},{"style":137},[2000],{"type":49,"value":2001}," medium",{"type":43,"tag":124,"props":2003,"children":2004},{"style":137},[2005],{"type":49,"value":1201},{"type":43,"tag":124,"props":2007,"children":2008},{"style":571},[2009],{"type":49,"value":2010}," 47",{"type":43,"tag":124,"props":2012,"children":2013},{"style":189},[2014],{"type":49,"value":859},{"type":43,"tag":124,"props":2016,"children":2018},{"class":126,"line":2017},8,[2019,2024,2028,2033,2037,2041,2046,2050,2054,2059,2063],{"type":43,"tag":124,"props":2020,"children":2021},{"style":137},[2022],{"type":49,"value":2023},"  --tags",{"type":43,"tag":124,"props":2025,"children":2026},{"style":143},[2027],{"type":49,"value":610},{"type":43,"tag":124,"props":2029,"children":2030},{"style":137},[2031],{"type":49,"value":2032},"OS:Windows",{"type":43,"tag":124,"props":2034,"children":2035},{"style":143},[2036],{"type":49,"value":202},{"type":43,"tag":124,"props":2038,"children":2039},{"style":143},[2040],{"type":49,"value":610},{"type":43,"tag":124,"props":2042,"children":2043},{"style":137},[2044],{"type":49,"value":2045},"Tactic:Defense Evasion",{"type":43,"tag":124,"props":2047,"children":2048},{"style":143},[2049],{"type":49,"value":202},{"type":43,"tag":124,"props":2051,"children":2052},{"style":143},[2053],{"type":49,"value":610},{"type":43,"tag":124,"props":2055,"children":2056},{"style":137},[2057],{"type":49,"value":2058},"Tactic:Command and Control",{"type":43,"tag":124,"props":2060,"children":2061},{"style":143},[2062],{"type":49,"value":202},{"type":43,"tag":124,"props":2064,"children":2065},{"style":189},[2066],{"type":49,"value":859},{"type":43,"tag":124,"props":2068,"children":2070},{"class":126,"line":2069},9,[2071,2076,2080,2085,2089],{"type":43,"tag":124,"props":2072,"children":2073},{"style":137},[2074],{"type":49,"value":2075},"  --false-positives",{"type":43,"tag":124,"props":2077,"children":2078},{"style":143},[2079],{"type":49,"value":610},{"type":43,"tag":124,"props":2081,"children":2082},{"style":137},[2083],{"type":49,"value":2084},"IT administrators using certutil for legitimate certificate operations",{"type":43,"tag":124,"props":2086,"children":2087},{"style":143},[2088],{"type":49,"value":202},{"type":43,"tag":124,"props":2090,"children":2091},{"style":189},[2092],{"type":49,"value":859},{"type":43,"tag":124,"props":2094,"children":2096},{"class":126,"line":2095},10,[2097,2102,2106,2111,2115],{"type":43,"tag":124,"props":2098,"children":2099},{"style":137},[2100],{"type":49,"value":2101},"  --references",{"type":43,"tag":124,"props":2103,"children":2104},{"style":143},[2105],{"type":49,"value":610},{"type":43,"tag":124,"props":2107,"children":2108},{"style":137},[2109],{"type":49,"value":2110},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1140\u002F",{"type":43,"tag":124,"props":2112,"children":2113},{"style":143},[2114],{"type":49,"value":202},{"type":43,"tag":124,"props":2116,"children":2117},{"style":189},[2118],{"type":49,"value":859},{"type":43,"tag":124,"props":2120,"children":2122},{"class":126,"line":2121},11,[2123,2128,2133],{"type":43,"tag":124,"props":2124,"children":2125},{"style":137},[2126],{"type":49,"value":2127},"  --interval",{"type":43,"tag":124,"props":2129,"children":2130},{"style":137},[2131],{"type":49,"value":2132}," 5m",{"type":43,"tag":124,"props":2134,"children":2135},{"style":137},[2136],{"type":49,"value":2137}," --disabled\n",{"type":43,"tag":52,"props":2139,"children":2140},{},[2141,2143,2149,2151,2157,2159,2165],{"type":49,"value":2142},"For complex rules (EQL sequences, MITRE mappings, alert suppression), use ",{"type":43,"tag":58,"props":2144,"children":2146},{"className":2145},[],[2147],{"type":49,"value":2148},"create --from-file rule_definition.json",{"type":49,"value":2150}," and\n",{"type":43,"tag":58,"props":2152,"children":2154},{"className":2153},[],[2155],{"type":49,"value":2156},"--threat-file",{"type":49,"value":2158},". See ",{"type":43,"tag":2160,"props":2161,"children":2163},"a",{"href":2162},"references\u002Fdetection-api-reference.md",[2164],{"type":49,"value":2162},{"type":49,"value":2166}," for schema.",{"type":43,"tag":512,"props":2168,"children":2170},{"id":2169},"step-5-monitor-and-iterate",[2171],{"type":49,"value":2172},"Step 5: Monitor and iterate",{"type":43,"tag":52,"props":2174,"children":2175},{},[2176,2178,2184],{"type":49,"value":2177},"Monitor alert volume with ",{"type":43,"tag":58,"props":2179,"children":2181},{"className":2180},[],[2182],{"type":49,"value":2183},"noisy-rules --days 3 --top 10",{"type":49,"value":2185}," and tune false positives as needed.",{"type":43,"tag":1330,"props":2187,"children":2188},{},[],{"type":43,"tag":67,"props":2190,"children":2192},{"id":2191},"workflow-endpoint-behavior-rules-tuning",[2193],{"type":49,"value":2194},"Workflow: Endpoint behavior rules tuning",{"type":43,"tag":52,"props":2196,"children":2197},{},[2198,2200,2205,2207,2212,2214,2219],{"type":49,"value":2199},"Tune ",{"type":43,"tag":344,"props":2201,"children":2202},{},[2203],{"type":49,"value":2204},"Elastic Endpoint behavior rules",{"type":49,"value":2206}," by adding ",{"type":43,"tag":344,"props":2208,"children":2209},{},[2210],{"type":49,"value":2211},"Endpoint exceptions",{"type":49,"value":2213}," scoped to specific rules. Endpoint exceptions\nlive in ",{"type":43,"tag":344,"props":2215,"children":2216},{},[2217],{"type":49,"value":2218},"Security → Exceptions → Endpoint Security Exception List",{"type":49,"value":2220},", not under individual SIEM rules.",{"type":43,"tag":52,"props":2222,"children":2223},{},[2224,2229,2231,2237,2238,2244],{"type":43,"tag":344,"props":2225,"children":2226},{},[2227],{"type":49,"value":2228},"Key principles:",{"type":49,"value":2230}," Always fetch the rule definition from protections-artifacts first. Always scope exceptions to the\nrule (",{"type":43,"tag":58,"props":2232,"children":2234},{"className":2233},[],[2235],{"type":49,"value":2236},"rule.id",{"type":49,"value":530},{"type":43,"tag":58,"props":2239,"children":2241},{"className":2240},[],[2242],{"type":49,"value":2243},"rule.name",{"type":49,"value":2245},"). Use full paths over process names. Run the mandatory entity cross-check (Step 4b)\nbefore any exception. Simulate impact (Step 5b) and aim for ≥60% noise reduction.",{"type":43,"tag":52,"props":2247,"children":2248},{},[2249,2254,2256,2262,2264,2270,2272,2278],{"type":43,"tag":344,"props":2250,"children":2251},{},[2252],{"type":49,"value":2253},"Scripts:",{"type":49,"value":2255}," ",{"type":43,"tag":58,"props":2257,"children":2259},{"className":2258},[],[2260],{"type":49,"value":2261},"fetch-endpoint-rule-from-github.js",{"type":49,"value":2263}," (get rule TOML by id), ",{"type":43,"tag":58,"props":2265,"children":2267},{"className":2266},[],[2268],{"type":49,"value":2269},"add-endpoint-exception.js",{"type":49,"value":2271}," (add to Endpoint\nException List; rule.id\u002Frule.name required), ",{"type":43,"tag":58,"props":2273,"children":2275},{"className":2274},[],[2276],{"type":49,"value":2277},"check-exclusion-best-practices.js",{"type":49,"value":65},{"type":43,"tag":52,"props":2280,"children":2281},{},[2282,2284,2289,2291,2296],{"type":49,"value":2283},"For the full step-by-step workflow (Steps 1–6), queries, and simulation templates, see\n",{"type":43,"tag":2160,"props":2285,"children":2287},{"href":2286},"references\u002Fendpoint-behavior-tuning-workflow.md",[2288],{"type":49,"value":2286},{"type":49,"value":2290},". For exclusion best\npractices, see\n",{"type":43,"tag":2160,"props":2292,"children":2294},{"href":2293},"references\u002Fendpoint-rule-exclusion-best-practices.md",[2295],{"type":49,"value":2293},{"type":49,"value":65},{"type":43,"tag":1330,"props":2298,"children":2299},{},[],{"type":43,"tag":67,"props":2301,"children":2303},{"id":2302},"tool-reference",[2304],{"type":49,"value":2305},"Tool reference",{"type":43,"tag":512,"props":2307,"children":2309},{"id":2308},"rule-managerjs",[2310],{"type":49,"value":63},{"type":43,"tag":52,"props":2312,"children":2313},{},[2314],{"type":49,"value":2315},"All commands are run from the workspace root. All output is JSON unless noted.",{"type":43,"tag":310,"props":2317,"children":2318},{},[2319,2335],{"type":43,"tag":314,"props":2320,"children":2321},{},[2322],{"type":43,"tag":318,"props":2323,"children":2324},{},[2325,2330],{"type":43,"tag":322,"props":2326,"children":2327},{},[2328],{"type":49,"value":2329},"Command",{"type":43,"tag":322,"props":2331,"children":2332},{},[2333],{"type":49,"value":2334},"Description",{"type":43,"tag":333,"props":2336,"children":2337},{},[2338,2354,2384,2407,2423,2439,2455,2471,2487,2503,2519,2536,2553,2569],{"type":43,"tag":318,"props":2339,"children":2340},{},[2341,2349],{"type":43,"tag":340,"props":2342,"children":2343},{},[2344],{"type":43,"tag":58,"props":2345,"children":2347},{"className":2346},[],[2348],{"type":49,"value":536},{"type":43,"tag":340,"props":2350,"children":2351},{},[2352],{"type":49,"value":2353},"Search\u002Flist rules with optional KQL filter",{"type":43,"tag":318,"props":2355,"children":2356},{},[2357,2366],{"type":43,"tag":340,"props":2358,"children":2359},{},[2360],{"type":43,"tag":58,"props":2361,"children":2363},{"className":2362},[],[2364],{"type":49,"value":2365},"get",{"type":43,"tag":340,"props":2367,"children":2368},{},[2369,2371,2377,2378],{"type":49,"value":2370},"Get a rule by ",{"type":43,"tag":58,"props":2372,"children":2374},{"className":2373},[],[2375],{"type":49,"value":2376},"--id",{"type":49,"value":530},{"type":43,"tag":58,"props":2379,"children":2381},{"className":2380},[],[2382],{"type":49,"value":2383},"--rule-id",{"type":43,"tag":318,"props":2385,"children":2386},{},[2387,2395],{"type":43,"tag":340,"props":2388,"children":2389},{},[2390],{"type":43,"tag":58,"props":2391,"children":2393},{"className":2392},[],[2394],{"type":49,"value":1725},{"type":43,"tag":340,"props":2396,"children":2397},{},[2398,2400,2406],{"type":49,"value":2399},"Create a rule (inline flags or ",{"type":43,"tag":58,"props":2401,"children":2403},{"className":2402},[],[2404],{"type":49,"value":2405},"--from-file",{"type":49,"value":1799},{"type":43,"tag":318,"props":2408,"children":2409},{},[2410,2418],{"type":43,"tag":340,"props":2411,"children":2412},{},[2413],{"type":43,"tag":58,"props":2414,"children":2416},{"className":2415},[],[2417],{"type":49,"value":1261},{"type":43,"tag":340,"props":2419,"children":2420},{},[2421],{"type":49,"value":2422},"Patch specific fields on a rule",{"type":43,"tag":318,"props":2424,"children":2425},{},[2426,2434],{"type":43,"tag":340,"props":2427,"children":2428},{},[2429],{"type":43,"tag":58,"props":2430,"children":2432},{"className":2431},[],[2433],{"type":49,"value":1269},{"type":43,"tag":340,"props":2435,"children":2436},{},[2437],{"type":49,"value":2438},"Enable a rule",{"type":43,"tag":318,"props":2440,"children":2441},{},[2442,2450],{"type":43,"tag":340,"props":2443,"children":2444},{},[2445],{"type":43,"tag":58,"props":2446,"children":2448},{"className":2447},[],[2449],{"type":49,"value":1276},{"type":43,"tag":340,"props":2451,"children":2452},{},[2453],{"type":49,"value":2454},"Disable a rule",{"type":43,"tag":318,"props":2456,"children":2457},{},[2458,2466],{"type":43,"tag":340,"props":2459,"children":2460},{},[2461],{"type":43,"tag":58,"props":2462,"children":2464},{"className":2463},[],[2465],{"type":49,"value":1283},{"type":43,"tag":340,"props":2467,"children":2468},{},[2469],{"type":49,"value":2470},"Delete a rule",{"type":43,"tag":318,"props":2472,"children":2473},{},[2474,2482],{"type":43,"tag":340,"props":2475,"children":2476},{},[2477],{"type":43,"tag":58,"props":2478,"children":2480},{"className":2479},[],[2481],{"type":49,"value":186},{"type":43,"tag":340,"props":2483,"children":2484},{},[2485],{"type":49,"value":2486},"Export rules as NDJSON",{"type":43,"tag":318,"props":2488,"children":2489},{},[2490,2498],{"type":43,"tag":340,"props":2491,"children":2492},{},[2493],{"type":43,"tag":58,"props":2494,"children":2496},{"className":2495},[],[2497],{"type":49,"value":1297},{"type":43,"tag":340,"props":2499,"children":2500},{},[2501],{"type":49,"value":2502},"Bulk enable\u002Fdisable\u002Fdelete\u002Fduplicate\u002Fedit",{"type":43,"tag":318,"props":2504,"children":2505},{},[2506,2514],{"type":43,"tag":340,"props":2507,"children":2508},{},[2509],{"type":43,"tag":58,"props":2510,"children":2512},{"className":2511},[],[2513],{"type":49,"value":1290},{"type":43,"tag":340,"props":2515,"children":2516},{},[2517],{"type":49,"value":2518},"Add an exception item to a rule",{"type":43,"tag":318,"props":2520,"children":2521},{},[2522,2531],{"type":43,"tag":340,"props":2523,"children":2524},{},[2525],{"type":43,"tag":58,"props":2526,"children":2528},{"className":2527},[],[2529],{"type":49,"value":2530},"list-exceptions",{"type":43,"tag":340,"props":2532,"children":2533},{},[2534],{"type":49,"value":2535},"List items on an exception list",{"type":43,"tag":318,"props":2537,"children":2538},{},[2539,2548],{"type":43,"tag":340,"props":2540,"children":2541},{},[2542],{"type":43,"tag":58,"props":2543,"children":2545},{"className":2544},[],[2546],{"type":49,"value":2547},"create-shared-list",{"type":43,"tag":340,"props":2549,"children":2550},{},[2551],{"type":49,"value":2552},"Create a shared exception list",{"type":43,"tag":318,"props":2554,"children":2555},{},[2556,2564],{"type":43,"tag":340,"props":2557,"children":2558},{},[2559],{"type":43,"tag":58,"props":2560,"children":2562},{"className":2561},[],[2563],{"type":49,"value":528},{"type":43,"tag":340,"props":2565,"children":2566},{},[2567],{"type":49,"value":2568},"Find noisiest rules by alert volume",{"type":43,"tag":318,"props":2570,"children":2571},{},[2572,2580],{"type":43,"tag":340,"props":2573,"children":2574},{},[2575],{"type":43,"tag":58,"props":2576,"children":2578},{"className":2577},[],[2579],{"type":49,"value":1654},{"type":43,"tag":340,"props":2581,"children":2582},{},[2583],{"type":49,"value":2584},"Check query syntax before create\u002Fpatch",{"type":43,"tag":52,"props":2586,"children":2587},{},[2588,2593,2594,2599,2600,2605,2607,2612],{"type":43,"tag":344,"props":2589,"children":2590},{},[2591],{"type":49,"value":2592},"Endpoint behavior tuning:",{"type":49,"value":2255},{"type":43,"tag":58,"props":2595,"children":2597},{"className":2596},[],[2598],{"type":49,"value":2261},{"type":49,"value":2263},{"type":43,"tag":58,"props":2601,"children":2603},{"className":2602},[],[2604],{"type":49,"value":2269},{"type":49,"value":2606},"\n(add to Endpoint Exception List; rule.id\u002Frule.name required), ",{"type":43,"tag":58,"props":2608,"children":2610},{"className":2609},[],[2611],{"type":49,"value":2277},{"type":49,"value":65},{"type":43,"tag":512,"props":2614,"children":2616},{"id":2615},"exception-entry-format",[2617],{"type":49,"value":2618},"Exception entry format",{"type":43,"tag":52,"props":2620,"children":2621},{},[2622,2624,2630,2632,2638,2639,2645,2646,2652,2653,2659,2660,2666,2667,2673,2674,2679,2680,2686,2688,2694,2695,2701],{"type":49,"value":2623},"Pass entries as ",{"type":43,"tag":58,"props":2625,"children":2627},{"className":2626},[],[2628],{"type":49,"value":2629},"field:operator:value",{"type":49,"value":2631},". Operators: ",{"type":43,"tag":58,"props":2633,"children":2635},{"className":2634},[],[2636],{"type":49,"value":2637},"is",{"type":49,"value":1263},{"type":43,"tag":58,"props":2640,"children":2642},{"className":2641},[],[2643],{"type":49,"value":2644},"is_not",{"type":49,"value":1263},{"type":43,"tag":58,"props":2647,"children":2649},{"className":2648},[],[2650],{"type":49,"value":2651},"is_one_of",{"type":49,"value":1263},{"type":43,"tag":58,"props":2654,"children":2656},{"className":2655},[],[2657],{"type":49,"value":2658},"is_not_one_of",{"type":49,"value":1263},{"type":43,"tag":58,"props":2661,"children":2663},{"className":2662},[],[2664],{"type":49,"value":2665},"exists",{"type":49,"value":1364},{"type":43,"tag":58,"props":2668,"children":2670},{"className":2669},[],[2671],{"type":49,"value":2672},"does_not_exist",{"type":49,"value":1263},{"type":43,"tag":58,"props":2675,"children":2677},{"className":2676},[],[2678],{"type":49,"value":829},{"type":49,"value":1263},{"type":43,"tag":58,"props":2681,"children":2683},{"className":2682},[],[2684],{"type":49,"value":2685},"does_not_match",{"type":49,"value":2687},". Example: ",{"type":43,"tag":58,"props":2689,"children":2691},{"className":2690},[],[2692],{"type":49,"value":2693},"process.name:is:svchost.exe",{"type":49,"value":1364},{"type":43,"tag":58,"props":2696,"children":2698},{"className":2697},[],[2699],{"type":49,"value":2700},"file.path:matches:C:\\\\Program Files\\\\*",{"type":49,"value":65},{"type":43,"tag":67,"props":2703,"children":2705},{"id":2704},"additional-resources",[2706],{"type":49,"value":2707},"Additional resources",{"type":43,"tag":74,"props":2709,"children":2710},{},[2711,2720,2742,2755],{"type":43,"tag":78,"props":2712,"children":2713},{},[2714,2716],{"type":49,"value":2715},"For full API schema details, see ",{"type":43,"tag":2160,"props":2717,"children":2718},{"href":2162},[2719],{"type":49,"value":2162},{"type":43,"tag":78,"props":2721,"children":2722},{},[2723,2725,2730,2732,2737,2738],{"type":49,"value":2724},"For ",{"type":43,"tag":344,"props":2726,"children":2727},{},[2728],{"type":49,"value":2729},"endpoint behavior",{"type":49,"value":2731}," tuning: ",{"type":43,"tag":2160,"props":2733,"children":2735},{"href":2734},"references\u002Fendpoint-exceptions-guide.md",[2736],{"type":49,"value":2734},{"type":49,"value":1364},{"type":43,"tag":2160,"props":2739,"children":2740},{"href":2293},[2741],{"type":49,"value":2293},{"type":43,"tag":78,"props":2743,"children":2744},{},[2745,2747,2753],{"type":49,"value":2746},"For alert investigation during tuning, use the ",{"type":43,"tag":58,"props":2748,"children":2750},{"className":2749},[],[2751],{"type":49,"value":2752},"alert-triage",{"type":49,"value":2754}," skill",{"type":43,"tag":78,"props":2756,"children":2757},{},[2758,2760,2765],{"type":49,"value":2759},"For documenting tuning actions in cases, use the ",{"type":43,"tag":58,"props":2761,"children":2763},{"className":2762},[],[2764],{"type":49,"value":1326},{"type":49,"value":2754},{"type":43,"tag":67,"props":2767,"children":2769},{"id":2768},"examples",[2770],{"type":49,"value":2771},"Examples",{"type":43,"tag":74,"props":2773,"children":2774},{},[2775,2780,2785],{"type":43,"tag":78,"props":2776,"children":2777},{},[2778],{"type":49,"value":2779},"\"Find the noisiest detection rules from the last 7 days and help me tune one\"",{"type":43,"tag":78,"props":2781,"children":2782},{},[2783],{"type":49,"value":2784},"\"Add an exception to exclude SCCM from the suspicious PowerShell rule\"",{"type":43,"tag":78,"props":2786,"children":2787},{},[2788],{"type":49,"value":2789},"\"Create a new detection rule for certutil URL download or decode\"",{"type":43,"tag":67,"props":2791,"children":2793},{"id":2792},"guidelines",[2794],{"type":49,"value":2795},"Guidelines",{"type":43,"tag":74,"props":2797,"children":2798},{},[2799,2809,2819,2829,2839,2849],{"type":43,"tag":78,"props":2800,"children":2801},{},[2802,2807],{"type":43,"tag":344,"props":2803,"children":2804},{},[2805],{"type":49,"value":2806},"Report only tool output.",{"type":49,"value":2808}," When summarizing results, quote or paraphrase only what the tools returned. Do not invent\nIDs, hostnames, IPs, scores, process trees, or other details not present in the tool response.",{"type":43,"tag":78,"props":2810,"children":2811},{},[2812,2817],{"type":43,"tag":344,"props":2813,"children":2814},{},[2815],{"type":49,"value":2816},"Preserve identifiers from the request.",{"type":49,"value":2818}," If the user provides specific hostnames, agent IDs, case IDs, or other\nvalues, use those exact values in tool calls and responses — do not substitute different identifiers.",{"type":43,"tag":78,"props":2820,"children":2821},{},[2822,2827],{"type":43,"tag":344,"props":2823,"children":2824},{},[2825],{"type":49,"value":2826},"Confirm actions concisely.",{"type":49,"value":2828}," After executing a tool, confirm what was done using the tool's return data. Do not\nfabricate internal IDs, metadata, or status details unless they appear in the tool response.",{"type":43,"tag":78,"props":2830,"children":2831},{},[2832,2837],{"type":43,"tag":344,"props":2833,"children":2834},{},[2835],{"type":49,"value":2836},"Distinguish facts from inference.",{"type":49,"value":2838}," If you draw conclusions beyond what the tools returned (e.g., suggesting a MITRE\ntechnique based on observed behavior), clearly label those as your assessment rather than presenting them as tool\noutput.",{"type":43,"tag":78,"props":2840,"children":2841},{},[2842,2847],{"type":43,"tag":344,"props":2843,"children":2844},{},[2845],{"type":49,"value":2846},"Start executing tools immediately.",{"type":49,"value":2848}," Do not read SKILL.md, browse directories, or list files before acting.",{"type":43,"tag":78,"props":2850,"children":2851},{},[2852,2857],{"type":43,"tag":344,"props":2853,"children":2854},{},[2855],{"type":49,"value":2856},"Report tool output verbatim.",{"type":49,"value":2858}," Copy rule IDs, names, alert counts, and error messages exactly as returned. Do not\nabbreviate UUIDs or round numbers.",{"type":43,"tag":67,"props":2860,"children":2862},{"id":2861},"production-use",[2863],{"type":49,"value":2864},"Production use",{"type":43,"tag":74,"props":2866,"children":2867},{},[2868,2937,2961,2966],{"type":43,"tag":78,"props":2869,"children":2870},{},[2871,2873,2878,2879,2884,2885,2890,2891,2896,2897,2902,2903,2908,2909,2914,2915,2921,2923,2928,2929,2935],{"type":49,"value":2872},"All write operations (",{"type":43,"tag":58,"props":2874,"children":2876},{"className":2875},[],[2877],{"type":49,"value":1725},{"type":49,"value":1263},{"type":43,"tag":58,"props":2880,"children":2882},{"className":2881},[],[2883],{"type":49,"value":1261},{"type":49,"value":1263},{"type":43,"tag":58,"props":2886,"children":2888},{"className":2887},[],[2889],{"type":49,"value":1269},{"type":49,"value":1263},{"type":43,"tag":58,"props":2892,"children":2894},{"className":2893},[],[2895],{"type":49,"value":1276},{"type":49,"value":1263},{"type":43,"tag":58,"props":2898,"children":2900},{"className":2899},[],[2901],{"type":49,"value":1283},{"type":49,"value":1263},{"type":43,"tag":58,"props":2904,"children":2906},{"className":2905},[],[2907],{"type":49,"value":1290},{"type":49,"value":1263},{"type":43,"tag":58,"props":2910,"children":2912},{"className":2911},[],[2913],{"type":49,"value":1297},{"type":49,"value":1364},{"type":43,"tag":58,"props":2916,"children":2918},{"className":2917},[],[2919],{"type":49,"value":2920},"add-endpoint-exception",{"type":49,"value":2922},") prompt for confirmation. Pass ",{"type":43,"tag":58,"props":2924,"children":2926},{"className":2925},[],[2927],{"type":49,"value":1305},{"type":49,"value":530},{"type":43,"tag":58,"props":2930,"children":2932},{"className":2931},[],[2933],{"type":49,"value":2934},"-y",{"type":49,"value":2936}," to skip when called by an agent.",{"type":43,"tag":78,"props":2938,"children":2939},{},[2940,2945,2947,2952,2954,2959],{"type":43,"tag":344,"props":2941,"children":2942},{},[2943],{"type":49,"value":2944},"Endpoint exceptions suppress detections globally.",{"type":49,"value":2946}," Always scope exceptions to a specific rule using ",{"type":43,"tag":58,"props":2948,"children":2950},{"className":2949},[],[2951],{"type":49,"value":2236},{"type":49,"value":2953}," or\n",{"type":43,"tag":58,"props":2955,"children":2957},{"className":2956},[],[2958],{"type":49,"value":2243},{"type":49,"value":2960}," in the entries. A broad, unscoped exception can silently reduce detection coverage.",{"type":43,"tag":78,"props":2962,"children":2963},{},[2964],{"type":49,"value":2965},"Verify environment variables point to the intended cluster before running any script.",{"type":43,"tag":78,"props":2967,"children":2968},{},[2969,2971,2977,2979,2984],{"type":49,"value":2970},"Use ",{"type":43,"tag":58,"props":2972,"children":2974},{"className":2973},[],[2975],{"type":49,"value":2976},"--dry-run",{"type":49,"value":2978}," with ",{"type":43,"tag":58,"props":2980,"children":2982},{"className":2981},[],[2983],{"type":49,"value":1297},{"type":49,"value":2985}," to preview impact before executing bulk changes.",{"type":43,"tag":67,"props":2987,"children":2989},{"id":2988},"environment-variables",[2990],{"type":49,"value":2991},"Environment variables",{"type":43,"tag":310,"props":2993,"children":2994},{},[2995,3015],{"type":43,"tag":314,"props":2996,"children":2997},{},[2998],{"type":43,"tag":318,"props":2999,"children":3000},{},[3001,3006,3011],{"type":43,"tag":322,"props":3002,"children":3003},{},[3004],{"type":49,"value":3005},"Variable",{"type":43,"tag":322,"props":3007,"children":3008},{},[3009],{"type":49,"value":3010},"Required",{"type":43,"tag":322,"props":3012,"children":3013},{},[3014],{"type":49,"value":2334},{"type":43,"tag":333,"props":3016,"children":3017},{},[3018,3040,3061,3082],{"type":43,"tag":318,"props":3019,"children":3020},{},[3021,3030,3035],{"type":43,"tag":340,"props":3022,"children":3023},{},[3024],{"type":43,"tag":58,"props":3025,"children":3027},{"className":3026},[],[3028],{"type":49,"value":3029},"ELASTICSEARCH_URL",{"type":43,"tag":340,"props":3031,"children":3032},{},[3033],{"type":49,"value":3034},"Yes",{"type":43,"tag":340,"props":3036,"children":3037},{},[3038],{"type":49,"value":3039},"Elasticsearch URL (for noisy-rules aggregation)",{"type":43,"tag":318,"props":3041,"children":3042},{},[3043,3052,3056],{"type":43,"tag":340,"props":3044,"children":3045},{},[3046],{"type":43,"tag":58,"props":3047,"children":3049},{"className":3048},[],[3050],{"type":49,"value":3051},"ELASTICSEARCH_API_KEY",{"type":43,"tag":340,"props":3053,"children":3054},{},[3055],{"type":49,"value":3034},{"type":43,"tag":340,"props":3057,"children":3058},{},[3059],{"type":49,"value":3060},"Elasticsearch API key",{"type":43,"tag":318,"props":3062,"children":3063},{},[3064,3073,3077],{"type":43,"tag":340,"props":3065,"children":3066},{},[3067],{"type":43,"tag":58,"props":3068,"children":3070},{"className":3069},[],[3071],{"type":49,"value":3072},"KIBANA_URL",{"type":43,"tag":340,"props":3074,"children":3075},{},[3076],{"type":49,"value":3034},{"type":43,"tag":340,"props":3078,"children":3079},{},[3080],{"type":49,"value":3081},"Kibana URL (for rules API)",{"type":43,"tag":318,"props":3083,"children":3084},{},[3085,3094,3098],{"type":43,"tag":340,"props":3086,"children":3087},{},[3088],{"type":43,"tag":58,"props":3089,"children":3091},{"className":3090},[],[3092],{"type":49,"value":3093},"KIBANA_API_KEY",{"type":43,"tag":340,"props":3095,"children":3096},{},[3097],{"type":49,"value":3034},{"type":43,"tag":340,"props":3099,"children":3100},{},[3101],{"type":49,"value":3102},"Kibana API key",{"type":43,"tag":3104,"props":3105,"children":3106},"style",{},[3107],{"type":49,"value":3108},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3110,"total":3278},[3111,3130,3147,3162,3179,3191,3201,3214,3226,3241,3252,3265],{"slug":3112,"name":3112,"fn":3113,"description":3114,"org":3115,"tags":3116,"stars":3127,"repoUrl":3128,"updatedAt":3129},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3117,3120,3123,3124],{"name":3118,"slug":3119,"type":15},"Analytics","analytics",{"name":3121,"slug":3122,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":3125,"slug":3126,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3131,"name":3131,"fn":3132,"description":3133,"org":3134,"tags":3135,"stars":3127,"repoUrl":3128,"updatedAt":3146},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3136,3139,3140,3143],{"name":3137,"slug":3138,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3141,"slug":3142,"type":15},"Engineering","engineering",{"name":3144,"slug":3145,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3148,"name":3148,"fn":3149,"description":3150,"org":3151,"tags":3152,"stars":3127,"repoUrl":3128,"updatedAt":3161},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3153,3154,3157,3158],{"name":9,"slug":8,"type":15},{"name":3155,"slug":3156,"type":15},"Elasticsearch","elasticsearch",{"name":3125,"slug":3126,"type":15},{"name":3159,"slug":3160,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":3163,"name":3163,"fn":3164,"description":3165,"org":3166,"tags":3167,"stars":23,"repoUrl":24,"updatedAt":3178},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3168,3171,3172,3175],{"name":3169,"slug":3170,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3173,"slug":3174,"type":15},"Operations","operations",{"name":3176,"slug":3177,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":3180,"name":3180,"fn":3181,"description":3182,"org":3183,"tags":3184,"stars":23,"repoUrl":24,"updatedAt":3190},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3185,3186,3189],{"name":3169,"slug":3170,"type":15},{"name":3187,"slug":3188,"type":15},"Deployment","deployment",{"name":3155,"slug":3156,"type":15},"2026-07-12T07:46:42.353362",{"slug":3192,"name":3192,"fn":3193,"description":3194,"org":3195,"tags":3196,"stars":23,"repoUrl":24,"updatedAt":3200},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3197,3198,3199],{"name":3169,"slug":3170,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3173,"slug":3174,"type":15},"2026-07-12T07:46:41.097412",{"slug":3202,"name":3202,"fn":3203,"description":3204,"org":3205,"tags":3206,"stars":23,"repoUrl":24,"updatedAt":3213},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3207,3208,3209,3212],{"name":3169,"slug":3170,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3210,"slug":3211,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":3215,"name":3215,"fn":3216,"description":3217,"org":3218,"tags":3219,"stars":23,"repoUrl":24,"updatedAt":3225},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3220,3223,3224],{"name":3221,"slug":3222,"type":15},"Authentication","authentication",{"name":3169,"slug":3170,"type":15},{"name":3155,"slug":3156,"type":15},"2026-07-12T07:46:39.783105",{"slug":3227,"name":3227,"fn":3228,"description":3229,"org":3230,"tags":3231,"stars":23,"repoUrl":24,"updatedAt":3240},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3232,3235,3236,3239],{"name":3233,"slug":3234,"type":15},"Audit","audit",{"name":3155,"slug":3156,"type":15},{"name":3237,"slug":3238,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":3242,"name":3242,"fn":3243,"description":3244,"org":3245,"tags":3246,"stars":23,"repoUrl":24,"updatedAt":3251},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3247,3248,3249,3250],{"name":3221,"slug":3222,"type":15},{"name":9,"slug":8,"type":15},{"name":3155,"slug":3156,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":3253,"name":3253,"fn":3254,"description":3255,"org":3256,"tags":3257,"stars":23,"repoUrl":24,"updatedAt":3264},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3258,3259,3260,3263],{"name":9,"slug":8,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3261,"slug":3262,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":3266,"name":3266,"fn":3267,"description":3268,"org":3269,"tags":3270,"stars":23,"repoUrl":24,"updatedAt":3277},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3271,3272,3273,3274],{"name":3118,"slug":3119,"type":15},{"name":3121,"slug":3122,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3275,"slug":3276,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":3280,"total":3327},[3281,3288,3294,3300,3307,3313,3320],{"slug":3163,"name":3163,"fn":3164,"description":3165,"org":3282,"tags":3283,"stars":23,"repoUrl":24,"updatedAt":3178},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3284,3285,3286,3287],{"name":3169,"slug":3170,"type":15},{"name":9,"slug":8,"type":15},{"name":3173,"slug":3174,"type":15},{"name":3176,"slug":3177,"type":15},{"slug":3180,"name":3180,"fn":3181,"description":3182,"org":3289,"tags":3290,"stars":23,"repoUrl":24,"updatedAt":3190},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3291,3292,3293],{"name":3169,"slug":3170,"type":15},{"name":3187,"slug":3188,"type":15},{"name":3155,"slug":3156,"type":15},{"slug":3192,"name":3192,"fn":3193,"description":3194,"org":3295,"tags":3296,"stars":23,"repoUrl":24,"updatedAt":3200},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3297,3298,3299],{"name":3169,"slug":3170,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3173,"slug":3174,"type":15},{"slug":3202,"name":3202,"fn":3203,"description":3204,"org":3301,"tags":3302,"stars":23,"repoUrl":24,"updatedAt":3213},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3303,3304,3305,3306],{"name":3169,"slug":3170,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3210,"slug":3211,"type":15},{"name":13,"slug":14,"type":15},{"slug":3215,"name":3215,"fn":3216,"description":3217,"org":3308,"tags":3309,"stars":23,"repoUrl":24,"updatedAt":3225},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3310,3311,3312],{"name":3221,"slug":3222,"type":15},{"name":3169,"slug":3170,"type":15},{"name":3155,"slug":3156,"type":15},{"slug":3227,"name":3227,"fn":3228,"description":3229,"org":3314,"tags":3315,"stars":23,"repoUrl":24,"updatedAt":3240},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3316,3317,3318,3319],{"name":3233,"slug":3234,"type":15},{"name":3155,"slug":3156,"type":15},{"name":3237,"slug":3238,"type":15},{"name":13,"slug":14,"type":15},{"slug":3242,"name":3242,"fn":3243,"description":3244,"org":3321,"tags":3322,"stars":23,"repoUrl":24,"updatedAt":3251},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3323,3324,3325,3326],{"name":3221,"slug":3222,"type":15},{"name":9,"slug":8,"type":15},{"name":3155,"slug":3156,"type":15},{"name":13,"slug":14,"type":15},35]