SOC › Module 5 › Lesson 3
Tuning Hygiene
Tuning hygiene names false-positive control, exclusions, testing, and change tickets — document tuning plan on YOUR $SOC_LAB rule sketch only.
Visual · t29_tuning_hygiene
Rule tuning literacy. $SOC_LAB only. Original Cyberlium.
Opening
Every untuned rule eats L1 sleep — literacy names exclusions and test plans before production noise.
Tuning reduces false positives: service account exclusions, maintenance window suppressions, geo allowlists, threshold adjustments, and enrichment requirements. Change control means ticket, peer review, rollback plan, and measure alert volume before/after — practiced as paperwork on lab rules. Cyberlium writes tuning plan for YOUR $SOC_LAB brute-force sketch — fictional service accounts and maintenance windows. Next: Rules Lab.
1. Tuning techniques (named)
Exclusions: known scan accounts, vulnerability scanners with ticket ID. Threshold tweaks: raise count or widen window after baseline. Enrichment gates: alert only if also proxy deny. Suppression: change window with documented end time.
On $SOC_LAB, list two exclusions you would document for noisy auth rule on sample data.
Command guide
Try these commands — Tuning techniques (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma false positives — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide MITRE T1110 — https://attack.mitre.org/techniques/T1110/ NIST detection — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
python3 - <<'PY'
import json, os, collections
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
fails = [json.loads(l) for l in open(os.path.join(lab,'logs','auth.jsonl')) if json.loads(l).get('event_id')==4625]
by_ip = collections.Counter(e['src_ip'] for e in fails)
print('Validate YOUR sigma stub against seeded auth.jsonl:')
for ip, n in by_ip.items():
flag = 'MATCH' if n >= 2 else 'below threshold'
print(f' {ip}: {n} x 4625 — {flag}')
PYCommand — copy this
grep falsepositives "$SOC_LAB/rules/failed-logon-lab.yml"
Primary tools to practice this lesson: grep, python3. Reference sites: Sigma false positives (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); MITRE T1110 (https://attack.mitre.org/techniques/T1110/); NIST detection (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why tuning is a team sport
L1 feedback feeds L2 rule owners. Untuned brute-force rules fire on every password typo Monday morning. Document who approved exclusion and when it expires.
Defenders track alert KPIs — students write before/after hypothesis on lab paperwork.
3. Literacy ≠ silent prod changes
Forbidden: editing production rules without ticket or peer review. Allowed: tuning plan — two exclusions, one threshold change, test checklist, $SOC_LAB rule reference.
Ship: tuning plan for YOUR lab rule sketch. Next: Rules Lab.
4. What you ship: tuning plan for $SOC_LAB rule sketch
Exclusions, threshold note, test checklist. $SOC_LAB named. NO silent prod edits. chmod 600.
5. What you record before the next lesson
Date. Tuning plan. $SOC_LAB named. File t29-m05-l03-tuning-hygiene.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable rule in production without ticket because noisy. Add permanent exclusion without expiry review.
Right
Write tuning plan for YOUR $SOC_LAB rule sketch. Next: Rules Lab.
Mission: tune YOUR lab rule on paper
1) List two false-positive causes on sample. 2) Write matching exclusions. 3) Draft test checklist before deploy (lab paper only). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Exclusions need owners and expiry — permanent 'ignore admin' becomes missed compromise.
Knowledge Check
APPLY: Rule tuning primarily reduces:
Multiple choice
Knowledge Check
APPLY: True or False: Production rule changes should use tickets and peer review.
True or False
Knowledge Check
APPLY: Tuning hygiene on Cyberlium means:
Multiple choice