[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GYRPC23YNK7G2TYQK3W8XD":3,"skill-same:01M6GYRPC23YNK7G2TYQK3W8XD":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6GYRPC23YNK7G2TYQK3W8XD","implementing-siem-use-cases-for-detection",null,"Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"detection","for","implementing","use","implementing siem use cases for detection","siem","soc","splunk","detection-engineering","elastic","sentinel","cybersecurity","mitre-attack","SOC-operations","coverage","library","across","alerts","expand","analytics","2026-11-10 10:12:30",false,"---\nname: implementing-siem-use-cases-for-detection\ndescription: >\n  Implements SIEM detection use cases by designing correlation rules, threshold alerts, and\n  behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel.\n  Use when SOC teams need to expand detection coverage, formalize use case lifecycle management,\n  or build a detection library aligned to organizational threat profile.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags: [soc, siem, use-cases, detection-engineering, mitre-attack, splunk, elastic, sentinel]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Implementing SIEM Use Cases for Detection\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to build or expand their SIEM detection library from scratch\n- Threat assessments identify ATT&CK technique gaps requiring new detection rules\n- Detection engineers need a structured process for use case design, testing, and deployment\n- Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX)\n\n**Do not use** for ad-hoc hunting queries — use cases are formalized, tested, and maintained detection rules, not exploratory searches.\n\n## Prerequisites\n\n- SIEM platform (Splunk ES, Elastic Security, or Microsoft Sentinel) with production data\n- ATT&CK Navigator for coverage gap analysis\n- Log sources normalized to CIM\u002FECS field standards\n- Use case documentation framework (wiki, Git repo, or detection engineering platform)\n- Testing environment with attack simulation tools (Atomic Red Team, MITRE Caldera)\n\n## Workflow\n\n### Step 1: Assess Detection Coverage Gaps\n\nMap current detection rules to ATT&CK and identify gaps:\n\n```python\nimport json\n\n# Load current detection rules mapped to ATT&CK\ncurrent_rules = [\n    {\"name\": \"Brute Force Detection\", \"techniques\": [\"T1110.001\", \"T1110.003\"]},\n    {\"name\": \"Malware Hash Match\", \"techniques\": [\"T1204.002\"]},\n    {\"name\": \"Suspicious PowerShell\", \"techniques\": [\"T1059.001\"]},\n]\n\n# Load ATT&CK Enterprise techniques\nwith open(\"enterprise-attack.json\") as f:\n    attack = json.load(f)\n\nall_techniques = set()\nfor obj in attack[\"objects\"]:\n    if obj[\"type\"] == \"attack-pattern\":\n        ext = obj.get(\"external_references\", [])\n        for ref in ext:\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                all_techniques.add(ref[\"external_id\"])\n\ncovered = set()\nfor rule in current_rules:\n    covered.update(rule[\"techniques\"])\n\ngaps = all_techniques - covered\nprint(f\"Total techniques: {len(all_techniques)}\")\nprint(f\"Covered: {len(covered)} ({len(covered)\u002Flen(all_techniques)*100:.1f}%)\")\nprint(f\"Gaps: {len(gaps)}\")\n\n# Prioritize gaps by threat relevance\npriority_techniques = [\n    \"T1003\", \"T1021\", \"T1053\", \"T1547\", \"T1078\",\n    \"T1055\", \"T1071\", \"T1105\", \"T1036\", \"T1070\"\n]\npriority_gaps = [t for t in priority_techniques if t in gaps]\nprint(f\"Priority gaps: {priority_gaps}\")\n```\n\n### Step 2: Design Use Case Specification\n\nDocument each use case with a standardized template:\n\n```yaml\nuse_case_id: UC-2024-015\nname: Credential Dumping via LSASS Access\ndescription: Detects tools accessing LSASS process memory for credential extraction\nmitre_attack:\n  tactic: Credential Access (TA0006)\n  technique: T1003.001 - LSASS Memory\n  data_sources:\n    - Process: OS API Execution (Sysmon EventCode 10)\n    - Process: Process Access (Windows Security 4663)\nlog_sources:\n  - index: sysmon, sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\n  - index: wineventlog, sourcetype: WinEventLog:Security\nseverity: High\nconfidence: Medium-High\nfalse_positive_sources:\n  - Antivirus products scanning LSASS\n  - CrowdStrike Falcon sensor\n  - Windows Defender ATP\n  - SCCM client\ntuning_notes: >\n  Maintain exclusion list for known security tools that legitimately access LSASS.\n  Review exclusions quarterly for newly deployed security products.\nsla: Alert within 5 minutes of detection\nowner: detection_engineering_team\nstatus: Production\ncreated: 2024-03-15\nlast_tested: 2024-03-15\n```\n\n### Step 3: Implement Detection Logic Across Platforms\n\n**Splunk ES Correlation Search:**\n```spl\n| tstats summariesonly=true count from datamodel=Endpoint.Processes\n  where Processes.process_name=\"lsass.exe\"\n  by Processes.dest, Processes.user, Processes.process_name,\n     Processes.parent_process_name, Processes.parent_process\n| `drop_dm_object_name(Processes)`\n| lookup lsass_access_whitelist parent_process AS parent_process OUTPUT is_whitelisted\n| where isnull(is_whitelisted) OR is_whitelisted!=\"true\"\n| `credential_dumping_lsass_filter`\n```\n\nOr using raw Sysmon data:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\nNOT [| inputlookup lsass_whitelist.csv | fields SourceImage]\n| stats count, values(GrantedAccess) AS access_flags by Computer, SourceImage, SourceUser\n| where count > 0\n```\n\n**Elastic Security EQL Rule:**\n```eql\nprocess where event.type == \"access\" and\n  process.name == \"lsass.exe\" and\n  not process.executable : (\n    \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n    \"?:\\\\Windows\\\\System32\\\\csrss.exe\",\n    \"?:\\\\Program Files\\\\CrowdStrike\\\\*\",\n    \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*\"\n  )\n```\n\n**Microsoft Sentinel KQL Rule:**\n```kql\nDeviceProcessEvents\n| where Timestamp > ago(1h)\n| where FileName == \"lsass.exe\"\n| where ActionType == \"ProcessAccessed\"\n| where InitiatingProcessFileName !in (\"svchost.exe\", \"csrss.exe\", \"MsMpEng.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName,\n          InitiatingProcessCommandLine, AccountName\n```\n\n### Step 4: Test with Attack Simulation\n\nValidate detection rules using Atomic Red Team:\n\n```bash\n# Install Atomic Red Team\nIEX (IWR 'https:\u002F\u002Fraw.githubusercontent.com\u002Fredcanaryco\u002Finvoke-atomicredteam\u002Fmaster\u002Finstall-atomicredteam.ps1' -UseBasicParsing)\nInstall-AtomicRedTeam -getAtomics\n\n# Execute T1003.001 - Credential Dumping\nInvoke-AtomicTest T1003.001 -TestNumbers 1,2,3\n\n# Execute T1053.005 - Scheduled Task\nInvoke-AtomicTest T1053.005 -TestNumbers 1\n\n# Execute T1547.001 - Registry Run Key\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2\n```\n\nVerify detection in SIEM:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nearliest=-1h\n| stats count by Computer, SourceImage, GrantedAccess\n| where count > 0\n```\n\nDocument test results:\n```\nTEST RESULTS — UC-2024-015\nAtomic Test T1003.001-1 (Mimikatz):      DETECTED (alert fired in 47s)\nAtomic Test T1003.001-2 (ProcDump):      DETECTED (alert fired in 32s)\nAtomic Test T1003.001-3 (Task Manager):  FALSE NEGATIVE (excluded by whitelist — expected)\nFalse Positive Rate (7-day backtest):     2 events (CrowdStrike scan — added to whitelist)\n```\n\n### Step 5: Deploy and Monitor Use Case Health\n\nTrack detection rule effectiveness:\n\n```spl\n-- Use case firing frequency\nindex=notable\n| stats count AS fires, dc(src) AS unique_sources,\n        dc(dest) AS unique_dests\n  by rule_name, status_label\n| eval true_positive_rate = round(\n    sum(eval(if(status_label=\"Resolved - True Positive\", 1, 0))) \u002F\n    count * 100, 1)\n| sort - fires\n| table rule_name, fires, unique_sources, unique_dests, true_positive_rate\n\n-- Detection latency monitoring\nindex=notable\n| eval detection_latency = _time - orig_time\n| stats avg(detection_latency) AS avg_latency_sec,\n        perc95(detection_latency) AS p95_latency_sec\n  by rule_name\n| eval avg_latency_min = round(avg_latency_sec \u002F 60, 1)\n| sort - avg_latency_sec\n```\n\n### Step 6: Maintain Use Case Library\n\nEstablish lifecycle management for all detection use cases:\n\n```\nUSE CASE LIFECYCLE\n━━━━━━━━━━━━━━━━━━\n1. PROPOSED    → New detection need identified (threat intel, gap analysis, incident finding)\n2. DEVELOPMENT → Query written, false positive analysis, tuning\n3. TESTING     → Atomic Red Team validation, 7-day backtest\n4. STAGING     → Deployed in alert-only mode (no incident creation) for 14 days\n5. PRODUCTION  → Full production with incident creation and SOAR integration\n6. REVIEW      → Quarterly review of effectiveness, false positive rate, relevance\n7. DEPRECATED  → Technique no longer relevant or replaced by better detection\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Use Case** | Formalized detection rule with documented logic, testing, tuning, and lifecycle management |\n| **Detection Engineering** | Practice of designing, testing, and maintaining SIEM detection rules as a software development discipline |\n| **Correlation Search** | SIEM query that combines events from multiple sources to identify attack patterns |\n| **False Positive Rate** | Percentage of alerts that are benign activity — target \u003C20% for production use cases |\n| **Detection Latency** | Time between event occurrence and alert generation — target \u003C5 minutes for critical detections |\n| **ATT&CK Coverage** | Percentage of relevant ATT&CK techniques with at least one production detection rule |\n\n## Tools & Systems\n\n- **Splunk ES**: Enterprise SIEM with correlation searches, risk-based alerting, and Incident Review\n- **Elastic Security**: SIEM with detection rules, EQL sequences, and ML-based anomaly detection\n- **Microsoft Sentinel**: Cloud SIEM with KQL analytics rules, Fusion ML engine, and Lighthouse multi-tenant\n- **Atomic Red Team**: Open-source attack simulation framework for testing detection rules against ATT&CK techniques\n- **ATT&CK Navigator**: MITRE visualization tool for mapping and tracking detection coverage across techniques\n\n## Common Scenarios\n\n- **Post-Incident Use Case**: After a ransomware incident, build detection for the initial access vector discovered during investigation\n- **Compliance-Driven**: PCI DSS requires detection of admin account misuse — build use cases for 4672\u002F4720\u002F4732 events\n- **Threat-Intel Driven**: New APT group targets your sector — build use cases for their documented TTPs\n- **Red Team Findings**: Purple team exercise identifies blind spots — convert findings into production detection rules\n- **SIEM Migration**: Migrating from QRadar to Splunk — convert and validate all existing use cases on new platform\n\n## Output Format\n\n```\nUSE CASE DEPLOYMENT REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━\nQuarter:      Q1 2024\nTotal Use Cases: 147 (Production: 128, Staging: 12, Development: 7)\n\nNew Deployments This Quarter:\n  UC-2024-012  Kerberoasting Detection (T1558.003)     — Production\n  UC-2024-013  DLL Side-Loading (T1574.002)            — Production\n  UC-2024-014  Scheduled Task Persistence (T1053.005)  — Production\n  UC-2024-015  LSASS Memory Access (T1003.001)         — Staging\n\nATT&CK Coverage:\n  Overall: 67% of relevant techniques (up from 61%)\n  Initial Access:      78%\n  Execution:           82%\n  Persistence:         71%\n  Credential Access:   65%\n  Lateral Movement:    58% (priority gap area)\n\nHealth Metrics:\n  Avg True Positive Rate:    74% (target: >70%)\n  Avg Detection Latency:     2.3 min (target: \u003C5 min)\n  Use Cases Deprecated:      3 (replaced by improved versions)\n```\n","# Implementing SIEM Use Cases for Detection\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to build or expand their SIEM detection library from scratch\n- Threat assessments identify ATT&CK technique gaps requiring new detection rules\n- Detection engineers need a structured process for use case design, testing, and deployment\n- Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX)\n\n**Do not use** for ad-hoc hunting queries — use cases are formalized, tested, and maintained detection rules, not exploratory searches.\n\n## Prerequisites\n\n- SIEM platform (Splunk ES, Elastic Security, or Microsoft Sentinel) with production data\n- ATT&CK Navigator for coverage gap analysis\n- Log sources normalized to CIM\u002FECS field standards\n- Use case documentation framework (wiki, Git repo, or detection engineering platform)\n- Testing environment with attack simulation tools (Atomic Red Team, MITRE Caldera)\n\n## Workflow\n\n### Step 1: Assess Detection Coverage Gaps\n\nMap current detection rules to ATT&CK and identify gaps:\n\n```python\nimport json\n\n# Load current detection rules mapped to ATT&CK\ncurrent_rules = [\n    {\"name\": \"Brute Force Detection\", \"techniques\": [\"T1110.001\", \"T1110.003\"]},\n    {\"name\": \"Malware Hash Match\", \"techniques\": [\"T1204.002\"]},\n    {\"name\": \"Suspicious PowerShell\", \"techniques\": [\"T1059.001\"]},\n]\n\n# Load ATT&CK Enterprise techniques\nwith open(\"enterprise-attack.json\") as f:\n    attack = json.load(f)\n\nall_techniques = set()\nfor obj in attack[\"objects\"]:\n    if obj[\"type\"] == \"attack-pattern\":\n        ext = obj.get(\"external_references\", [])\n        for ref in ext:\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                all_techniques.add(ref[\"external_id\"])\n\ncovered = set()\nfor rule in current_rules:\n    covered.update(rule[\"techniques\"])\n\ngaps = all_techniques - covered\nprint(f\"Total techniques: {len(all_techniques)}\")\nprint(f\"Covered: {len(covered)} ({len(covered)\u002Flen(all_techniques)*100:.1f}%)\")\nprint(f\"Gaps: {len(gaps)}\")\n\n# Prioritize gaps by threat relevance\npriority_techniques = [\n    \"T1003\", \"T1021\", \"T1053\", \"T1547\", \"T1078\",\n    \"T1055\", \"T1071\", \"T1105\", \"T1036\", \"T1070\"\n]\npriority_gaps = [t for t in priority_techniques if t in gaps]\nprint(f\"Priority gaps: {priority_gaps}\")\n```\n\n### Step 2: Design Use Case Specification\n\nDocument each use case with a standardized template:\n\n```yaml\nuse_case_id: UC-2024-015\nname: Credential Dumping via LSASS Access\ndescription: Detects tools accessing LSASS process memory for credential extraction\nmitre_attack:\n  tactic: Credential Access (TA0006)\n  technique: T1003.001 - LSASS Memory\n  data_sources:\n    - Process: OS API Execution (Sysmon EventCode 10)\n    - Process: Process Access (Windows Security 4663)\nlog_sources:\n  - index: sysmon, sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\n  - index: wineventlog, sourcetype: WinEventLog:Security\nseverity: High\nconfidence: Medium-High\nfalse_positive_sources:\n  - Antivirus products scanning LSASS\n  - CrowdStrike Falcon sensor\n  - Windows Defender ATP\n  - SCCM client\ntuning_notes: >\n  Maintain exclusion list for known security tools that legitimately access LSASS.\n  Review exclusions quarterly for newly deployed security products.\nsla: Alert within 5 minutes of detection\nowner: detection_engineering_team\nstatus: Production\ncreated: 2024-03-15\nlast_tested: 2024-03-15\n```\n\n### Step 3: Implement Detection Logic Across Platforms\n\n**Splunk ES Correlation Search:**\n```spl\n| tstats summariesonly=true count from datamodel=Endpoint.Processes\n  where Processes.process_name=\"lsass.exe\"\n  by Processes.dest, Processes.user, Processes.process_name,\n     Processes.parent_process_name, Processes.parent_process\n| `drop_dm_object_name(Processes)`\n| lookup lsass_access_whitelist parent_process AS parent_process OUTPUT is_whitelisted\n| where isnull(is_whitelisted) OR is_whitelisted!=\"true\"\n| `credential_dumping_lsass_filter`\n```\n\nOr using raw Sysmon data:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\nNOT [| inputlookup lsass_whitelist.csv | fields SourceImage]\n| stats count, values(GrantedAccess) AS access_flags by Computer, SourceImage, SourceUser\n| where count > 0\n```\n\n**Elastic Security EQL Rule:**\n```eql\nprocess where event.type == \"access\" and\n  process.name == \"lsass.exe\" and\n  not process.executable : (\n    \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n    \"?:\\\\Windows\\\\System32\\\\csrss.exe\",\n    \"?:\\\\Program Files\\\\CrowdStrike\\\\*\",\n    \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*\"\n  )\n```\n\n**Microsoft Sentinel KQL Rule:**\n```kql\nDeviceProcessEvents\n| where Timestamp > ago(1h)\n| where FileName == \"lsass.exe\"\n| where ActionType == \"ProcessAccessed\"\n| where InitiatingProcessFileName !in (\"svchost.exe\", \"csrss.exe\", \"MsMpEng.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName,\n          InitiatingProcessCommandLine, AccountName\n```\n\n### Step 4: Test with Attack Simulation\n\nValidate detection rules using Atomic Red Team:\n\n```bash\n# Install Atomic Red Team\nIEX (IWR 'https:\u002F\u002Fraw.githubusercontent.com\u002Fredcanaryco\u002Finvoke-atomicredteam\u002Fmaster\u002Finstall-atomicredteam.ps1' -UseBasicParsing)\nInstall-AtomicRedTeam -getAtomics\n\n# Execute T1003.001 - Credential Dumping\nInvoke-AtomicTest T1003.001 -TestNumbers 1,2,3\n\n# Execute T1053.005 - Scheduled Task\nInvoke-AtomicTest T1053.005 -TestNumbers 1\n\n# Execute T1547.001 - Registry Run Key\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2\n```\n\nVerify detection in SIEM:\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nearliest=-1h\n| stats count by Computer, SourceImage, GrantedAccess\n| where count > 0\n```\n\nDocument test results:\n```\nTEST RESULTS — UC-2024-015\nAtomic Test T1003.001-1 (Mimikatz):      DETECTED (alert fired in 47s)\nAtomic Test T1003.001-2 (ProcDump):      DETECTED (alert fired in 32s)\nAtomic Test T1003.001-3 (Task Manager):  FALSE NEGATIVE (excluded by whitelist — expected)\nFalse Positive Rate (7-day backtest):     2 events (CrowdStrike scan — added to whitelist)\n```\n\n### Step 5: Deploy and Monitor Use Case Health\n\nTrack detection rule effectiveness:\n\n```spl\n-- Use case firing frequency\nindex=notable\n| stats count AS fires, dc(src) AS unique_sources,\n        dc(dest) AS unique_dests\n  by rule_name, status_label\n| eval true_positive_rate = round(\n    sum(eval(if(status_label=\"Resolved - True Positive\", 1, 0))) \u002F\n    count * 100, 1)\n| sort - fires\n| table rule_name, fires, unique_sources, unique_dests, true_positive_rate\n\n-- Detection latency monitoring\nindex=notable\n| eval detection_latency = _time - orig_time\n| stats avg(detection_latency) AS avg_latency_sec,\n        perc95(detection_latency) AS p95_latency_sec\n  by rule_name\n| eval avg_latency_min = round(avg_latency_sec \u002F 60, 1)\n| sort - avg_latency_sec\n```\n\n### Step 6: Maintain Use Case Library\n\nEstablish lifecycle management for all detection use cases:\n\n```\nUSE CASE LIFECYCLE\n━━━━━━━━━━━━━━━━━━\n1. PROPOSED    → New detection need identified (threat intel, gap analysis, incident finding)\n2. DEVELOPMENT → Query written, false positive analysis, tuning\n3. TESTING     → Atomic Red Team validation, 7-day backtest\n4. STAGING     → Deployed in alert-only mode (no incident creation) for 14 days\n5. PRODUCTION  → Full production with incident creation and SOAR integration\n6. REVIEW      → Quarterly review of effectiveness, false positive rate, relevance\n7. DEPRECATED  → Technique no longer relevant or replaced by better detection\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Use Case** | Formalized detection rule with documented logic, testing, tuning, and lifecycle management |\n| **Detection Engineering** | Practice of designing, testing, and maintaining SIEM detection rules as a software development discipline |\n| **Correlation Search** | SIEM query that combines events from multiple sources to identify attack patterns |\n| **False Positive Rate** | Percentage of alerts that are benign activity — target \u003C20% for production use cases |\n| **Detection Latency** | Time between event occurrence and alert generation — target \u003C5 minutes for critical detections |\n| **ATT&CK Coverage** | Percentage of relevant ATT&CK techniques with at least one production detection rule |\n\n## Tools & Systems\n\n- **Splunk ES**: Enterprise SIEM with correlation searches, risk-based alerting, and Incident Review\n- **Elastic Security**: SIEM with detection rules, EQL sequences, and ML-based anomaly detection\n- **Microsoft Sentinel**: Cloud SIEM with KQL analytics rules, Fusion ML engine, and Lighthouse multi-tenant\n- **Atomic Red Team**: Open-source attack simulation framework for testing detection rules against ATT&CK techniques\n- **ATT&CK Navigator**: MITRE visualization tool for mapping and tracking detection coverage across techniques\n\n## Common Scenarios\n\n- **Post-Incident Use Case**: After a ransomware incident, build detection for the initial access vector discovered during investigation\n- **Compliance-Driven**: PCI DSS requires detection of admin account misuse — build use cases for 4672\u002F4720\u002F4732 events\n- **Threat-Intel Driven**: New APT group targets your sector — build use cases for their documented TTPs\n- **Red Team Findings**: Purple team exercise identifies blind spots — convert findings into production detection rules\n- **SIEM Migration**: Migrating from QRadar to Splunk — convert and validate all existing use cases on new platform\n\n## Output Format\n\n```\nUSE CASE DEPLOYMENT REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━\nQuarter:      Q1 2024\nTotal Use Cases: 147 (Production: 128, Staging: 12, Development: 7)\n\nNew Deployments This Quarter:\n  UC-2024-012  Kerberoasting Detection (T1558.003)     — Production\n  UC-2024-013  DLL Side-Loading (T1574.002)            — Production\n  UC-2024-014  Scheduled Task Persistence (T1053.005)  — Production\n  UC-2024-015  LSASS Memory Access (T1003.001)         — Staging\n\nATT&CK Coverage:\n  Overall: 67% of relevant techniques (up from 61%)\n  Initial Access:      78%\n  Execution:           82%\n  Persistence:         71%\n  Credential Access:   65%\n  Lateral Movement:    58% (priority gap area)\n\nHealth Metrics:\n  Avg True Positive Rate:    74% (target: >70%)\n  Avg Detection Latency:     2.3 min (target: \u003C5 min)\n  Use Cases Deprecated:      3 (replaced by improved versions)\n```\n",{"name":5,"tags":43,"author":45,"domain":29,"license":14,"version":46,"subdomain":47,"description":48},[24,23,44,26,30,25,27,28],"use-cases","mahipal","1.0","soc-operations","Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-siem-use-cases-for-detection",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add micsapp\u002Fmicstec-skills --skill implementing-siem-use-cases-for-detection",{"tool":62,"command":63},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill implementing-siem-use-cases-for-detection",{"tool":65,"command":66},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill implementing-siem-use-cases-for-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002FSKILL.md",true,[70,75,81],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002FLICENSE",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-reference.md","REFERENCE","参考文档",2138,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002Freferences\u002Fapi-reference.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fagent.py","SCRIPT","脚本",8876,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-siem-use-cases-for-detection\u002Fscripts\u002Fagent.py",[88,125,154,174,194,219],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":105,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[95,100],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,19],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":139,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[131,132,135,138],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":133,"categoryName":134,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":136,"categoryName":137,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[140,141,142,143,107,144,145,146,147,148,149,150,115,116,122,151,152,123,153,20],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[160],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},[162,163,164,165,107,110,115,116,166,21,167,168,169,170,171,123,172,173,20,19],"policy","authoring","apim policy authoring","security","access","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":182,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[180,181],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[183,165,184,115,168,185,107,140,186,187,188,189,116,190,123,191,192,193,124,19],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[201,202,203,142,204,205,206,207,115,208,209,210,211,212,213,214,215,216,217,218],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":225,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[221,226,227,228,229,230,231,21,232,233],"npm","js","calculate","node","math","user","compute","errors"]