elastic / elastic/roadmap

AI-assisted security detection rules tuning

Open
#267 0 comments 0 reactions 1 assignee Claimed by @approksiu View on GitHub
product-area:security
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**Value proposition**
With AI-assisted detection rules tuning, detection engineers will save time on analysis of false positives, crafting and testing rule exceptions and rule logic modification.

**Expected outcome**
Detection engineering workflow with built-in AI-assistance supporting detection tuning task.

**Key user stories / use cases**
- As a detection engineer, I want to get AI assistance during the exception creation.
- As a detection engineer, I want AI-assisted analysis of the rule false positive rate provided to me, typical FP alerts analysed for commonalities, and exceptions suggested based on the analysis.
- As a detection engineer, I want to choose which exceptions I want to AI assistant to create.
- As a detection engineer, I want AI assistant to provide information about the impact of applied exceptions in the number of FP alerts that would not have been created, and the FP rate for the rule calculated retrospectively.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.