mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-11 21:54:56 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
2.1 KiB
2.1 KiB
API Reference: Implementing SIEM Use Cases for Detection
Libraries
attackcti (MITRE ATT&CK)
- Install:
pip install attackcti attack_client()-- Initialize ATT&CK data clientget_techniques()-- All techniques for coverage calculationget_groups()-- Threat groups for threat-informed use cases
splunk-sdk (Splunk Integration)
- Install:
pip install splunk-sdk splunklib.client.connect()-- Connect to Splunk instanceservice.jobs.create(query)-- Execute detection rule SPL
Use Case Lifecycle
| Phase | Activities |
|---|---|
| Design | Map to ATT&CK, define data sources, write detection logic |
| Test | Validate with Atomic Red Team, measure FP/TP rates |
| Deploy | Push to SIEM with alerting and SLA configuration |
| Tune | Refine based on FP feedback, add exclusions |
| Retire | Deprecate when superseded or no longer relevant |
Key ATT&CK Techniques for Use Cases
| ID | Name | Tactic |
|---|---|---|
| T1110 | Brute Force | Credential Access |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
| T1059.001 | PowerShell | Execution |
| T1048.003 | Exfiltration over DNS | Exfiltration |
| T1003.001 | LSASS Memory | Credential Access |
| T1098 | Account Manipulation | Persistence |
| T1486 | Data Encrypted for Impact | Impact |
Sigma Rule Format
- Spec: https://sigmahq.io/docs/basics/rules.html
- Fields:
title,logsource,detection,level,tags - Tools:
sigma-clifor converting to Splunk SPL, Elastic EQL, Sentinel KQL - Repository: https://github.com/SigmaHQ/sigma
Detection Quality Metrics
- True Positive Rate: Target >70%
- False Positive Rate: Target <30%
- Mean Time to Detect (MTTD): Varies by severity
- Coverage: Percentage of ATT&CK techniques with detections
External References
- ATT&CK Techniques: https://attack.mitre.org/techniques/enterprise/
- Sigma Rules: https://github.com/SigmaHQ/sigma
- Atomic Red Team: https://github.com/redcanaryco/atomic-red-team
- Splunk ES Detections: https://research.splunk.com/detections/
- Elastic Detection Rules: https://github.com/elastic/detection-rules