<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-detection-rule-tuning
description: >-
  Tune, optimize, and validate detection rules to reduce false positives while
  maintaining detection fidelity. Covers Sigma rule modification, SIEM query
  optimization, threshold tuning, allowlisting, and detection performance
  measurement across Splunk, Elastic, and Microsoft Sentinel.
domain: cybersecurity
subdomain: purple-team
tags:
  - detection-tuning
  - sigma
  - false-positive-reduction
  - siem
  - splunk
  - elastic
  - sentinel
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Detection Rule Tuning

## Overview

Detection rule tuning balances sensitivity and specificity. Untuned rules generate
alert fatigue that degrades SOC effectiveness. Purple team tuning uses adversary
emulation to verify that tuned rules still detect real attacks while suppressing
known-good activity.

## Prerequisites

| Requirement | Install |
|---|---|
| Sigma CLI | `pip install sigma-cli pySigma-backend-splunk pySigma-backend-elasticsearch` |
| Invoke-AtomicRedTeam | PowerShell module for detection validation |
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` or `brew install jq` |

## Key Concepts

### Tuning Lifecycle

```
Baseline → Emulate → Measure FP Rate → Tune → Re-emulate → Validate → Deploy
```

### Sigma Rule Tuning Patterns

```yaml
# Original rule with high false positives
title: Suspicious PowerShell Command Line
detection:
  selection:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'bypass'
  condition: selection
---
# Tuned rule with allowlist filter
title: Suspicious PowerShell Command Line (Tuned)
detection:
  selection:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'bypass'
  filter_legitimate:
    ParentImage|endswith:
      - '\sccm\bin\CcmExec.exe'
      - '\Microsoft Monitoring Agent\Agent\MonitoringHost.exe'
    User|contains:
      - 'SYSTEM'
  condition: selection and not filter_legitimate
```

### Splunk Threshold Tuning

```spl
| tstats count WHERE index=main sourcetype=WinEventLog:Security EventCode=4688
  BY Computer, CommandLine, _time span=1h
| where count > 5
| stats dc(Computer) as host_count, sum(count) as total_events BY CommandLine
| where host_count < 3
```

### Elastic Detection Rule Tuning

```json
{
  "rule_id": "custom-powershell-encoded",
  "exceptions_list": [
    {
      "field": "process.parent.executable",
      "operator": "included",
      "value": ["CcmExec.exe", "MonitoringHost.exe"]
    }
  ],
  "throttle": "1h",
  "actions_frequency": {
    "summary": true,
    "notifyWhen": "onThrottleInterval"
  }
}
```

## Workflow

### 1. Baseline False Positive Rate

```bash
# Count alerts per rule over 7 days (Splunk)
curl -s -k -u admin:changeme "https://splunk:8089/services/search/jobs" \
  -d 'search=search index=notable earliest=-7d | stats count by rule_name | sort -count'

# Elastic baseline
curl -s "http://elastic:9200/.alerts-*/_search" -H 'Content-Type: application/json' \
  -d '{"size":0,"query":{"range":{"@timestamp":{"gte":"now-7d"}}},"aggs":{"by_rule":{"terms":{"field":"signal.rule.name","size":50}}}}'
```

### 2. Identify High-FP Rules

```bash
# Extract top noisy rules
node agent.js baseline --siem-url https://splunk:8089 --days 7 --top 20
```

### 3. Apply Tuning

```bash
# Convert tuned Sigma rule to Splunk
sigma convert -t splunk -p splunk_cim rules/tuned_powershell.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows rules/tuned_powershell.yml

# Apply allowlist via agent
node agent.js tune --rule rules/powershell_encoded.yml \
  --add-filter 'ParentImage|endswith:\sccm\bin\CcmExec.exe' \
  --output rules/tuned/powershell_encoded.yml
```

### 4. Validate Detection Still Works

```powershell
# Re-run atomic test that should trigger the rule
Invoke-AtomicTest T1059.001 -TestNumbers 1

# Verify alert still fires within 5 minutes
Start-Sleep -Seconds 300
```

### 5. Measure Improvement

```bash
# Compare pre/post tuning FP rates
node agent.js compare --rule "Suspicious PowerShell Command Line" \
  --siem-url https://splunk:8089 --before 7d --after 1d
```

## Verification

| Check | Method |
|---|---|
| FP rate reduced | Alert count decreased post-tuning |
| True positives preserved | Atomic test still triggers alert |
| Rule syntax valid | `sigma check rules/tuned_rule.yml` |
| No detection gaps | Coverage report shows no regression |

## References

- [Sigma Rule Specification](https://github.com/SigmaHQ/sigma-specification)
- [Splunk Detection Tuning](https://docs.splunk.com/Documentation/ES)
- [Elastic Detection Rules](https://www.elastic.co/guide/en/security/current/detection-engine-overview.html)
