----------------
🛠️ Clankerusecase — Threat-led Detection Library
===================
Clankerusecase is a threat-led detection library providing detection rules across four platforms: Microsoft Defender KQL, Azure Sentinel KQL, Sigma, and Splunk SPL. The core value is reducing latency between threat intelligence publication and deployable detection content.
🔹 Two Content Tiers
Generic use cases are rule files stored in use_cases/*.yml that activate when an article mentions a known trigger keyword. For example, an article referencing psexec fires the rule UC_LATERAL_PSXEC. These are broadly applicable but lack specificity to individual campaigns. They provide baseline coverage for well-known techniques and tools.
AI-badged use cases represent a higher-fidelity tier. The pipeline feeds the source article to Claude, which generates bespoke detection logic targeting the exact campaign, threat actor, or malware family described. These rules are pinned to the specific IOCs and TTPs mentioned in the article. AI-badged use cases sort to the top of article cards and the matrix drawer to surface the highest-quality content first.
🔹 Cross-Verification Process
AI-generated detections undergo a cross-verification step via web search against authoritative vendor advisories: Microsoft Threat Intelligence, Mandiant, CrowdStrike, MITRE ATT&CK, and abuse.ch. Each AI-badged rule includes "Cross-checked against:" references linking back to these verification sources. This adds a validation layer that pure LLM-generated detection rules typically lack.
🔹 Platform Coverage and Filtering
Detection rules target four platforms, each with its own query language. The interface provides filter groups organized by Source, Content, Platform, Target, and Splunk category. On mobile viewports, the filter toolbar collapses behind a "Filters ▾" toggle to keep article cards above the fold.
🔹 Practical Considerations
For detection engineers, the AI-badged use cases offer campaign-specific hunting logic without starting from scratch. The cross-check against vendor advisories provides some confidence, though this does not replace manual validation in production. The generic rules provide baseline coverage for known patterns, while AI rules address the gap for novel or recently reported threats. The quality of AI-generated rules depends on Claude's ability to accurately extract IOCs and TTPs from source articles.
🔹 detection_engineering #KQL #sigma #splunk #tool
🔗 Source: https://clankerusecase.com/