mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-12 22:24:56 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
56 lines
2.1 KiB
Markdown
56 lines
2.1 KiB
Markdown
# API Reference: Implementing SIEM Use Cases for Detection
|
|
|
|
## Libraries
|
|
|
|
### attackcti (MITRE ATT&CK)
|
|
- **Install**: `pip install attackcti`
|
|
- `attack_client()` -- Initialize ATT&CK data client
|
|
- `get_techniques()` -- All techniques for coverage calculation
|
|
- `get_groups()` -- Threat groups for threat-informed use cases
|
|
|
|
### splunk-sdk (Splunk Integration)
|
|
- **Install**: `pip install splunk-sdk`
|
|
- `splunklib.client.connect()` -- Connect to Splunk instance
|
|
- `service.jobs.create(query)` -- Execute detection rule SPL
|
|
|
|
## Use Case Lifecycle
|
|
|
|
| Phase | Activities |
|
|
|-------|-----------|
|
|
| Design | Map to ATT&CK, define data sources, write detection logic |
|
|
| Test | Validate with Atomic Red Team, measure FP/TP rates |
|
|
| Deploy | Push to SIEM with alerting and SLA configuration |
|
|
| Tune | Refine based on FP feedback, add exclusions |
|
|
| Retire | Deprecate when superseded or no longer relevant |
|
|
|
|
## Key ATT&CK Techniques for Use Cases
|
|
|
|
| ID | Name | Tactic |
|
|
|----|------|--------|
|
|
| T1110 | Brute Force | Credential Access |
|
|
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
|
|
| T1059.001 | PowerShell | Execution |
|
|
| T1048.003 | Exfiltration over DNS | Exfiltration |
|
|
| T1003.001 | LSASS Memory | Credential Access |
|
|
| T1098 | Account Manipulation | Persistence |
|
|
| T1486 | Data Encrypted for Impact | Impact |
|
|
|
|
## Sigma Rule Format
|
|
- **Spec**: https://sigmahq.io/docs/basics/rules.html
|
|
- Fields: `title`, `logsource`, `detection`, `level`, `tags`
|
|
- Tools: `sigma-cli` for converting to Splunk SPL, Elastic EQL, Sentinel KQL
|
|
- Repository: https://github.com/SigmaHQ/sigma
|
|
|
|
## Detection Quality Metrics
|
|
- True Positive Rate: Target >70%
|
|
- False Positive Rate: Target <30%
|
|
- Mean Time to Detect (MTTD): Varies by severity
|
|
- Coverage: Percentage of ATT&CK techniques with detections
|
|
|
|
## External References
|
|
- ATT&CK Techniques: https://attack.mitre.org/techniques/enterprise/
|
|
- Sigma Rules: https://github.com/SigmaHQ/sigma
|
|
- Atomic Red Team: https://github.com/redcanaryco/atomic-red-team
|
|
- Splunk ES Detections: https://research.splunk.com/detections/
|
|
- Elastic Detection Rules: https://github.com/elastic/detection-rules
|