Initial commit - 611 cybersecurity skills across all subdomains

skills/building-detection-rule-with-splunk-spl/assets/template.md

@@ -0,0 +1,99 @@
+# Splunk SPL Detection Rule Template
+
+## Rule Metadata
+
+| Field | Value |
+|---|---|
+| Rule Name | |
+| Rule ID | |
+| Description | |
+| Author | |
+| Date Created | |
+| Last Modified | |
+| Severity | |
+| MITRE ATT&CK | |
+| Data Sources | |
+| Status | Draft / Testing / Production / Retired |
+
+## SPL Query
+
+```spl
+| tstats summariesonly=true count
+    from datamodel=<DataModel>
+    where <conditions>
+    by <fields>, _time span=<interval>
+| rename "<DataModel>.*" as *
+| stats <aggregation> by <grouping_fields>
+| where <threshold_condition>
+| lookup asset_lookup ip as src OUTPUT asset_name, asset_priority
+| lookup identity_lookup identity as user OUTPUT department, manager
+| eval severity=case(<critical_condition>, "critical", <high_condition>, "high", true(), "medium")
+| eval description="<dynamic description string>"
+| eval mitre_technique="<T-number>"
+```
+
+## Detection Logic
+
+### What This Rule Detects
+<!-- Describe the adversary behavior being detected -->
+
+### Data Sources Required
+<!-- List all required data sources and their sourcetypes -->
+
+| Source | Sourcetype | Index | Required Fields |
+|---|---|---|---|
+| | | | |
+
+### Threshold Justification
+<!-- Explain why the threshold values were chosen -->
+
+### Enrichment Details
+<!-- List lookups and threat intel sources used -->
+
+## Testing Plan
+
+### True Positive Test
+<!-- Describe how to simulate the attack to validate detection -->
+
+```
+Step 1:
+Step 2:
+Step 3:
+Expected Result:
+```
+
+### False Positive Analysis
+<!-- Document known benign scenarios that trigger this rule -->
+
+| Scenario | Source | Mitigation |
+|---|---|---|
+| | | |
+
+## Tuning History
+
+| Date | Change | Reason | Impact |
+|---|---|---|---|
+| | | | |
+
+## Correlation Search Configuration
+
+```
+Schedule: */15 * * * *
+Time Window: earliest=-20m latest=now
+Suppress: 1h by src_ip
+Notable Event Security Domain: threat
+Adaptive Response: <actions>
+```
+
+## Analyst Guidance
+
+### Triage Steps
+1.
+2.
+3.
+
+### Escalation Criteria
+-
+
+### Related Rules
+-