SOC › Module 5 › Lesson 3
Tuning L2
Tuning L2 literacy names false-positive control, hunt-driven rule feedback, exclusions, and change tickets — document tuning plan on YOUR $HUNT_LAB findings only.
Visual · t30_tuning_l2
L2 tuning literacy. $HUNT_LAB only. Original Cyberlium.
Opening
Hunts expose noisy rules — L2 tuning literacy names feedback loops without silent production edits.
L2 tuning feedback from hunts: service account exclusions, threshold adjustments, enrichment gates, maintenance window suppressions. Change control means ticket, peer review, rollback plan, measure alert volume before/after — practiced as paperwork on lab hunt outcomes. Cyberlium writes L2 tuning plan for YOUR $HUNT_LAB hunt sketch — fictional service accounts and maintenance windows. Next: Correlation Lab.
1. L2 tuning techniques (named)
Hunt-driven exclusion: scanner account with ticket ID on lab paper. Threshold tweak: raise failed-auth count after baseline from jq. Enrichment gate: alert only if also proxy deny in correlation sketch. Suppression: change window with documented end.
On $HUNT_LAB, list two tuning actions from one noisy hunt finding on sample data.
Command guide
Try these commands — L2 tuning techniques (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Detection tuning — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide Elastic tuning — https://www.elastic.co/guide/en/security/current/alerts-ui.html MITRE T1110 — https://attack.mitre.org/techniques/T1110/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/tuning-notes-l2.txt" <<'EOF'
L2 detection tuning (YOUR lab):
HNT-002 threshold: require >=3 failures within 5min before success
HNT-001 parent list: add excel.exe, outlook.exe besides winword.exe
HNT-003 beacon: tune interval variance ±30s to reduce FP on CDN
Exclude: known patch windows, authorized pentest IPs (lab doc only)
Validate against YOUR seeded logs — never tune on unauthorized prod data
EOFCommand — copy this
jq '[.[] | select(.mitre|startswith("T1110"))]' "$HUNT_LAB/logs/alerts.json"
grep -E 'threshold|Validate|HNT-' "$HUNT_LAB/hunt/tuning-notes-l2.txt"Primary tools to practice this lesson: jq, grep. Reference sites: Detection tuning (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic tuning (https://www.elastic.co/guide/en/security/current/alerts-ui.html); MITRE T1110 (https://attack.mitre.org/techniques/T1110/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why L2 tuning is feedback not ownership
L2 proposes; detection engineering or L3 approves and deploys. Untuned rules from ignored hunt feedback flood L1 — document who owns rule and ticket ID even on lab notes.
Defenders track alert KPIs — students write before/after hypothesis on lab paperwork.
3. Literacy ≠ silent prod changes
Forbidden: editing production rules without ticket or peer review. Allowed: L2 tuning plan — two proposals, test checklist, $HUNT_LAB hunt reference.
Ship: L2 tuning plan for YOUR lab hunt finding. Next: Correlation Lab.
4. What you ship: L2 tuning plan for $HUNT_LAB hunt finding
Two tuning proposals, test checklist, hunt reference. $HUNT_LAB named. NO silent prod edits. chmod 600.
5. What you record before the next lesson
Date. L2 tuning plan. $HUNT_LAB named. File t30-m05-l03-tuning-l2.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable rule in production without ticket. Add permanent exclusion without expiry review.
Right
Write L2 tuning plan for YOUR $HUNT_LAB hunt finding. Next: Correlation Lab.
Mission: tune YOUR lab hunt finding on paper
1) List two false-positive causes from hunt. 2) Write matching tuning proposals. 3) Draft test checklist (lab paper only). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Exclusions need owners and expiry — permanent 'ignore admin' becomes missed compromise.
Knowledge Check
APPLY: L2 tuning primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Production rule changes should use tickets and peer review.
True or False
Knowledge Check
APPLY: L2 tuning literacy on Cyberlium means:
Multiple choice