implementing-siem-use-cases-for-detection

# Implementing SIEM Use Cases for Detection ## When to Use Use this skill when: - SOC teams need to build or expand their SIEM detection library from scratch - Threat assessments identify ATT&CK technique gaps requiring new detection rules - Detection engineers need a structured process for use case design, testing, and deployment - Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX) **Do not use** for ad-hoc hunting queries — use cases are formalized, tested, and maintained detection rules, not exploratory searches. ## Prerequisites - SIEM platform (Splunk ES, Elastic Security, or Microsoft Sentinel) with production data - ATT&CK Navigator for coverage gap analysis - Log sources normalized to CIM/ECS field standards - Use case documentation framework (wiki, Git repo, or detection engineering platform) - Testing environment with attack simulation tools (Atomic Red Team, MITRE Caldera) ## Workflow ### Step 1: Assess Detection Coverage Gaps Map current detection rules to ATT&CK and identify gaps: ```python import json # Load current detection rules mapped to ATT&CK current_rules = [ {"name": "Brute Force Detection", "techniques": ["T1110.001", "T1110.003"]}, {"name": "Malware Hash Match", "techniques": ["T1204.002"]}, {"name": "Suspicious PowerShell", "techniques": ["T1059.001"]}, ] # Load ATT&CK Enterprise techniques with open("enterprise-attack.json") as f: attack = json.load(f) all_techniques = set() for obj in at...