How do I install the Security Detection Rule Management skill?

Run npx skillmds@latest add aspectrr/security-detection-rule-management in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Detection Rule Management safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Detection Rule Management?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Detection Rule Management free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Detection Rule Management?

aspectrr (@aspectrr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Detection Rule Management by aspectrr

Name: Security Detection Rule Management
Author: aspectrr

File contents

Detection Rule Management

Create new detection rules for emerging threats and tune existing rules to reduce false positives.

Prerequisites

export ELASTICSEARCH_URL="https://your-cluster.es.cloud.example.com:443"
export ELASTICSEARCH_API_KEY="your-api-key"
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"

Workflow: Tune noisy rules

Step 1: Find noisy rules

node skills/security/detection-rule-management/scripts/rule-manager.js noisy-rules --days 7 --top 20
node skills/security/detection-rule-management/scripts/rule-manager.js find --filter "alert.attributes.name:*Suspicious*" --brief
node skills/security/detection-rule-management/scripts/rule-manager.js get --id <rule_uuid>

Step 2: Investigate false positives

node skills/security/alert-triage/scripts/run-query.js "kibana.alert.rule.name:\"<rule_name>\"" --index ".alerts-security.alerts-*" --days 7 --full

Step 3: Tune

Add exception (preferred):

node skills/security/detection-rule-management/scripts/rule-manager.js add-exception \
  --rule-uuid <rule_uuid> \
  --entries "process.executable:is:C:\\Program Files\\SCCM\\CcmExec.exe" \
  --name "Exclude SCCM" --comment "FP: SCCM deployment" --yes

Patch query/threshold/severity:

node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --query "..." --yes
node skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --max-signals 50 --yes
node skills/security/detection-rule-management/scripts/rule-manager.js disable --id <rule_uuid> --yes

Workflow: Create new rule

Step 1: Define threat and data sources

Specify MITRE ATT&CK technique(s), required data sources, and malicious vs legitimate behavior.

Step 2: Test the query

node skills/security/alert-triage/scripts/run-query.js "process.name:certutil.exe" --index "logs-endpoint.events.process-*" --days 30

Step 3: Validate query

node skills/security/detection-rule-management/scripts/rule-manager.js validate-query \
  --query "process.name:taskkill.exe AND process.command_line:(*chrome.exe*)" --language kuery

Step 4: Create rule

node skills/security/detection-rule-management/scripts/rule-manager.js create \
  --name "Certutil URL Download" \
  --description "Detects certutil.exe used to download files or decode Base64." \
  --type query \
  --query "process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)" \
  --index "logs-endpoint.events.process-*" \
  --severity medium --risk-score 47 \
  --interval 5m --disabled

Tool Reference

Command	Description
`find`	Search/list rules
`get`	Get rule by ID
`create`	Create rule (inline or `--from-file`)
`patch`	Patch specific fields
`enable/disable`	Enable or disable rule
`delete`	Delete rule
`add-exception`	Add exception to rule
`noisy-rules`	Find noisiest rules by alert volume
`validate-query`	Check query syntax before create/patch

Guidelines

Report only tool output — do not invent IDs or details.
Preserve identifiers from requests exactly.
Start executing tools immediately — do not browse first.
All write operations prompt for confirmation. Pass --yes to skip.

---name: security-detection-rule-managementdescription: Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.---# Detection Rule ManagementCreate new detection rules for emerging threats and tune existing rules to reduce false positives.## Prerequisites```bashexport ELASTICSEARCH_URL="https://your-cluster.es.cloud.example.com:443"export ELASTICSEARCH_API_KEY="your-api-key"export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"export KIBANA_API_KEY="your-kibana-api-key"```## Workflow: Tune noisy rules### Step 1: Find noisy rules```bashnode skills/security/detection-rule-management/scripts/rule-manager.js noisy-rules --days 7 --top 20node skills/security/detection-rule-management/scripts/rule-manager.js find --filter "alert.attributes.name:*Suspicious*" --briefnode skills/security/detection-rule-management/scripts/rule-manager.js get --id <rule_uuid>```### Step 2: Investigate false positives```bashnode skills/security/alert-triage/scripts/run-query.js "kibana.alert.rule.name:\"<rule_name>\"" --index ".alerts-security.alerts-*" --days 7 --full```### Step 3: Tune**Add exception (preferred):**```bashnode skills/security/detection-rule-management/scripts/rule-manager.js add-exception \ --rule-uuid <rule_uuid> \ --entries "process.executable:is:C:\\Program Files\\SCCM\\CcmExec.exe" \ --name "Exclude SCCM" --comment "FP: SCCM deployment" --yes```**Patch query/threshold/severity:**```bashnode skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --query "..." --yesnode skills/security/detection-rule-management/scripts/rule-manager.js patch --id <rule_uuid> --max-signals 50 --yesnode skills/security/detection-rule-management/scripts/rule-manager.js disable --id <rule_uuid> --yes```## Workflow: Create new rule### Step 1: Define threat and data sourcesSpecify MITRE ATT&CK technique(s), required data sources, and malicious vs legitimate behavior.### Step 2: Test the query```bashnode skills/security/alert-triage/scripts/run-query.js "process.name:certutil.exe" --index "logs-endpoint.events.process-*" --days 30```### Step 3: Validate query```bashnode skills/security/detection-rule-management/scripts/rule-manager.js validate-query \ --query "process.name:taskkill.exe AND process.command_line:(*chrome.exe*)" --language kuery```### Step 4: Create rule```bashnode skills/security/detection-rule-management/scripts/rule-manager.js create \ --name "Certutil URL Download" \ --description "Detects certutil.exe used to download files or decode Base64." \ --type query \ --query "process.name:certutil.exe AND process.command_line:(*urlcache* OR *decode*)" \ --index "logs-endpoint.events.process-*" \ --severity medium --risk-score 47 \ --interval 5m --disabled```## Tool Reference| Command | Description || -------------------- | --------------------------------------------- || `find` | Search/list rules || `get` | Get rule by ID || `create` | Create rule (inline or `--from-file`) || `patch` | Patch specific fields || `enable/disable` | Enable or disable rule || `delete` | Delete rule || `add-exception` | Add exception to rule || `noisy-rules` | Find noisiest rules by alert volume || `validate-query` | Check query syntax before create/patch |## Guidelines- Report only tool output — do not invent IDs or details.- Preserve identifiers from requests exactly.- Start executing tools immediately — do not browse first.- All write operations prompt for confirmation. Pass `--yes` to skip.

Frequently asked questions

Security Detection Rule Management