raffkin

Find NOISY detection rules in Exabeam New-Scale — noisy, not merely loud — and propose specific, actionable tuning. Use when the analyst asks to "find noisy rules", "what's generating false positives", "tune detections", "reduce alert noise", "why is this rule so loud", or "which rules waste our time". Reads the rule inventory and case/detection history through the Exabeam MCP, separates high-volume-low-precision rules from high-volume-high-precision ones, and proposes tuning mapped to real Exabeam mechanics (context table, exclusion rule, or the rule's own filter/scope/maturity settings). Read-only and propose-only: the rule-write tools the MCP exposes are denied on both hosts — detection engineering applies the change. Requires the Exabeam MCP server to be configured.

Investigate and triage a security alert or case in Exabeam New-Scale, end to end. Use when the analyst hands over an alert/case ID or payload, or asks to "investigate", "triage this alert/case", "work this alert", or "is this a real threat?" — for one item at depth, not a whole queue (sweeping the queue is the `triage-cases` skill). Gathers evidence through the Exabeam MCP, correlates activity into a timeline, maps to MITRE ATT&CK, reaches a threat / false-positive verdict, takes the non-destructive terminal action (open a case, dismiss an alert, write case notes), and recommends any containment for the analyst to approve. Requires the Exabeam MCP server to be configured.

Prioritize a queue of open Exabeam New-Scale cases — decide what needs a human's attention first. Use when the analyst asks to "triage the queue", "what should I look at", "what needs attention", "sweep the open cases", "morning triage", or "prioritize", rather than handing over one specific case ID. Reads the open case queue through the Exabeam MCP, clusters cases by attack-shape, ranks them by corroborated signal (with the risk score as one tunable input, not the sole one), and returns a short "start here" list plus the noise clusters worth tuning. Read-only during the sweep: it prioritizes and flags, and may call an obvious verdict, but never auto-writes across the queue. Hand a single case to soc-investigate; hand a noise cluster to rule-tuning. Requires the Exabeam MCP server to be configured.