Purple › Module 8 › Lesson 3
Tuning Loop
Tuning loop literacy — detect → validate → tune → retest — iterative purple cycle on YOUR `$PURPLE_LAB` with honest feedback.
Visual · t35_tuning_loop
Tuning loop = named iterate rows. $PURPLE_LAB. Original Cyberlium.
Opening
Detection engineering is iterative — name the detect-validate-tune-retest loop on YOUR lab before declaring rules production-ready without test.
Tuning loop literacy names: atomic or log replay trigger category, detection fire/miss result category, rule tuning change stub category, false positive risk check category, and retest validation category. Analyst documents tuning loop iteration on `$PURPLE_LAB` — one complete cycle for a gap from 8-2 (atomic run → result → tune stub → retest plan) — without disabling rules in prod without ticket, without tuning to silence true positives dishonestly, without skipping retest. Cyberlium teaches honest purple iteration — YOUR notes chmod 600. Refused: unauthorized prod rule changes, dishonest tuning, skip retest. Lab row: tuning loop iteration (trigger, result, tune stub, FP check, retest plan).
1. Named loop rows
Trigger, result, tune stub, FP risk check, retest — five literacy anchors.
One complete cycle documented — not abstract 'we tune sometimes.'
Command guide
Try these commands — Named loop rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma tuning — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide Elastic tuning — https://www.elastic.co/guide/en/security/current/rules-ui.html MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/coverage/tuning-loop.md" <<'EOF'
# Detection Tuning Loop — purple feedback
1. Purple exercise produces finding (alert fired / missed / noisy)
2. Detection engineer updates Sigma stub or threshold
3. Re-test with jq on auth.jsonl (unit test plan UT-*)
4. Update coverage CSV status → validated
5. SOC brief on rule change + expected alert volume
Example tuning for failed-logon-lab.yml:
- Add: count >= 3 AND timespan 5m per src_ip
- Add falsepositive: break-glass admin account on lab
Loop continues — no one-time 'set and forget'
EOFCommand — copy this
grep -E 'tuning|threshold|coverage CSV|failed-logon' "$PURPLE_LAB/coverage/tuning-loop.md"
python3 -c "print('Tuning loop: finding → rule update → jq retest → coverage update')"Primary tools to practice this lesson: grep, python3. Reference sites: Sigma tuning (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic tuning (https://www.elastic.co/guide/en/security/current/rules-ui.html); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Honest results
Miss documented as miss — tuning addresses gap, not narrative spin.
FP risk row prevents over-tuning that blinds detection.
3. Refused
No unauthorized prod tuning; no dishonest miss-as-pass; no skip retest.
Loop literacy supports mature detections — not checkbox closure.
4. What you ship: tuning loop iteration
Trigger + result + tune stub + FP check + retest plan + NEVER dishonest tuning line.
5. What you record before the next lesson
Tuning loop iteration path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tune lab rule to never fire so atomic 'passes' without improving detection.
Right
Tuning loop iteration from `$PURPLE_LAB` gap register. Next: Coverage Lab.
Mission: tuning loop iteration
1) Name five tuning loop rows. 2) One complete cycle for a gap. 3) Honest fire/miss result documented. 4) Write NEVER dishonest tuning line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “FP risk check — minimum literacy content?”
Knowledge Check
APPLY: Tuning loop literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Rules may tune to silence without retest.
True or False
Knowledge Check
APPLY: Tuning loop includes:
Multiple choice