Anthropic-Cybersecurity-Skills/skills/performing-false-positive-reduction-in-siem/assets/template.md

False Positive Reduction Template

Rule Tuning Request

Field	Value
Rule Name
Current FP Rate
Target FP Rate
Alert Volume (30 days)
Root Cause Category	Threshold / Missing context / Known benign / Outdated

FP Root Cause Analysis

Sample #	Source	Classification	Root Cause	Recommended Fix
1		FP
2		FP
3		FP

Tuning Action Plan

• Adjust threshold from ___ to ___
• Add allowlist entries for: ___
• Add correlation with: ___
• Add enrichment lookup: ___
• Test with Atomic Red Team: ___
• Validate FP rate improvement after 7 days