🛡️ Cyber Defense & SOC · Detection & Purple Team

Engineer detections through a full lifecycle (Splunk)

Ship detection rules like code: versioned, tested, tuned, and retired deliberately.

advanced~40 minSOC AnalystsDetection EngineersThreat Hunters

Steps

1Draft rule from hunt/intel with explicit logic rationale documented
2Backtest against 30 days of data; measure raw hit volume
3Tune out benign-true noise using environment baselines, not blanket exclusions
4Stage: silent-run in prod for one week comparing predicted vs actual hits
5Enable with severity matched to expected fidelity; document false-positive budget
6Review rule precision quarterly; retire or rewrite below threshold
7Version rules in a git-backed ES correlation search repo
8Use data models to keep searches acceleration-friendly

Common Pitfalls

▲Rules enabled then never revisited until they page falsely
▲Exclusions so broad they hollow out the logic

Commands

Install with skills CLI

$ npx skills add aniruddhaadak80/skills --skill detection-purple-detection-rule-lifecycle-splunk

Install globally

$ npx skills add aniruddhaadak80/skills --skill detection-purple-detection-rule-lifecycle-splunk -g

Tags

#detection-engineering#as-code#cyber-defense-ops#detection-purple

Install this skill

$ npx skills add aniruddhaadak80/skills --skill detection-purple-detection-rule-lifecycle-splunk -a opencode

SKILL.md

# Engineer detections through a full lifecycle (Splunk)

> Ship detection rules like code: versioned, tested, tuned, and retired deliberately.

## When to Use This Skill

Ship detection rules like code: versioned, tested, tuned, and retired deliberately.

## Steps

1. Draft rule from hunt/intel with explicit logic rationale documented
2. Backtest against 30 days of data; measure raw hit volume
3. Tune out benign-true noise using environment baselines, not blanket exclusions
4. Stage: silent-run in prod for one week comparing predicted vs actual hits
5. Enable with severity matched to expected fidelity; document false-positive budget
6. Review rule precision quarterly; retire or rewrite below threshold
7. Version rules in a git-backed ES correlation search repo
8. Use data models to keep searches acceleration-friendly

## Common Pitfalls

- Rules enabled then never revisited until they page falsely
- Exclusions so broad they hollow out the logic

View source on GitHub ↗

Ship detection rules like code: versioned, tested, tuned, and retired deliberately.

🛡️ Cyber Defense & SOC·~40m

Open →

Validate detections with purple-team exercisesintermediate

Safe technique emulation proving alerts fire end-to-end, producing concrete coverage evidence.

🛡️ Cyber Defense & SOC·~40m

Open →

Facilitate ransomware tabletops that find truthintermediate

Scenario injects probing decision boundaries, revealing plan gaps without blame theater.

🛡️ Cyber Defense & SOC·~40m

Open →