Post details algorithmic generation of false-positive alert filters
FP-Growth ranks field combinations from a detection rule's context and offers analysts the top three candidate filters.
Stories per day · 30 days
Relatedai-agents1alert-filtering1cisco1false-positives1fp-growth1mcp1project-quarry1proof-of-concept1sigma1soc1splunk1threat-hunting1
7 stories, newest first · one card per story
Stories tagged #detection-rules
Cisco open-sources Project Quarry to flag rogue AI agents
Quarry scores full agent sessions, including tool use and MCP calls, and ships a YARA-like rule starter pack.
4
Encore compiles public exploit proofs into threat-hunting rules
Across 45 CVEs, Encore found 43 without reading logs and raised alerts on two wrong CVE pairs.
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
Elastic now grades more than 2,100 prebuilt SIEM rules monthly on noise, speed, and threat coverage.
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
Elastic explains how it scores 1,781 SIEM detection rules for noise, speed, and threat coverage.
Threat Coverage Digest: New Malware Reports and 1,100+ Detection Rules
ANY.RUN's September digest adds 76 behavior signatures, 16 YARA rules, and 1,098 Suricata rules plus TI reports on IronToll and CSuite phishing.
1
One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
Elastic validates centralized SOC alert triage using cross-project search across 100 linked Elastic Security Serverless projects with ~2,100 detection rules.
2