tune_rules
Generate a Sigma filter rule from false-positive and true-positive events, preserving true positives while minimizing false positives. Returns YAML, rationale, clusters, coverage, and verification.
Instructions
Propose a spec-native Sigma filter rule from false-positive and true-positive JSON event arrays. Rules come from inline yaml or a path confined to --rules-dir; select the target with rule when needed. Optional pipelines transform the target before tuning. The result includes filter YAML, field rationale, clusters, coverage, and closed before/after verification. No proposal may suppress a true positive.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Sigma file or directory path. Confined to `--rules-dir` when configured. | |
| rule | No | Target rule id, falling back to an exact title. | |
| yaml | No | Inline Sigma YAML. Mutually exclusive with `path`. | |
| author | No | Filter author metadata. | |
| filter_id | No | Caller-supplied filter id. Omit to leave the YAML id unset. | |
| pipelines | No | Processing pipelines as builtin names or confined file paths. | |
| max_fields | No | Maximum fields in one selection. | |
| min_fields | No | Minimum fields required in every emitted selection. | |
| max_clusters | No | Maximum selections in the emitted filter. | |
| allow_partial | No | Permit verified partial FP coverage. | |
| true_positives | Yes | Known true-positive events that the filter must preserve. | |
| false_positives | Yes | Events confirmed as false positives. | |
| min_cluster_support | No | Minimum FP events required for every emitted selection. | |
| max_value_cardinality | No | Maximum exact values in one OR list. |