Tuning L2

Tuning L2 literacy names false-positive control, hunt-driven rule feedback, exclusions, and change tickets — document tuning plan on YOUR $HUNT_LAB findings only.

Tuning L2• Audio Walkthrough

00:00/03:24

Visual · t30_tuning_l2

L2 tuning literacy. $HUNT_LAB only. Original Cyberlium.

Hunts expose noisy rules — L2 tuning literacy names feedback loops without silent production edits.

L2 tuning feedback from hunts: service account exclusions, threshold adjustments, enrichment gates, maintenance window suppressions. Change control means ticket, peer review, rollback plan, measure alert volume before/after — practiced as paperwork on lab hunt outcomes. Cyberlium writes L2 tuning plan for YOUR $HUNT_LAB hunt sketch — fictional service accounts and maintenance windows. Next: Correlation Lab.

1. L2 tuning techniques (named)

Hunt-driven exclusion: scanner account with ticket ID on lab paper. Threshold tweak: raise failed-auth count after baseline from jq. Enrichment gate: alert only if also proxy deny in correlation sketch. Suppression: change window with documented end.

On $HUNT_LAB, list two tuning actions from one noisy hunt finding on sample data.

Command guide

Try these commands — L2 tuning techniques (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Detection tuning — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide Elastic tuning — https://www.elastic.co/guide/en/security/current/alerts-ui.html MITRE T1110 — https://attack.mitre.org/techniques/T1110/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows:

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/tuning-notes-l2.txt" <<'EOF'
L2 detection tuning (YOUR lab):
  HNT-002 threshold: require >=3 failures within 5min before success
  HNT-001 parent list: add excel.exe, outlook.exe besides winword.exe
  HNT-003 beacon: tune interval variance ±30s to reduce FP on CDN
  Exclude: known patch windows, authorized pentest IPs (lab doc only)
Validate against YOUR seeded logs — never tune on unauthorized prod data
EOF

Command — copy this

jq '[.[] | select(.mitre|startswith("T1110"))]' "$HUNT_LAB/logs/alerts.json"
grep -E 'threshold|Validate|HNT-' "$HUNT_LAB/hunt/tuning-notes-l2.txt"

Primary tools to practice this lesson: jq, grep. Reference sites: Detection tuning (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic tuning (https://www.elastic.co/guide/en/security/current/alerts-ui.html); MITRE T1110 (https://attack.mitre.org/techniques/T1110/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why L2 tuning is feedback not ownership

L2 proposes; detection engineering or L3 approves and deploys. Untuned rules from ignored hunt feedback flood L1 — document who owns rule and ticket ID even on lab notes.

Defenders track alert KPIs — students write before/after hypothesis on lab paperwork.

3. Literacy ≠ silent prod changes

Forbidden: editing production rules without ticket or peer review. Allowed: L2 tuning plan — two proposals, test checklist, $HUNT_LAB hunt reference.

Ship: L2 tuning plan for YOUR lab hunt finding. Next: Correlation Lab.

4. What you ship: L2 tuning plan for $HUNT_LAB hunt finding

Two tuning proposals, test checklist, hunt reference. $HUNT_LAB named. NO silent prod edits. chmod 600.

5. What you record before the next lesson

Date. L2 tuning plan. $HUNT_LAB named. File t30-m05-l03-tuning-l2.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Disable rule in production without ticket. Add permanent exclusion without expiry review.
Right: Write L2 tuning plan for YOUR $HUNT_LAB hunt finding. Next: Correlation Lab.

Hands-on Exercise