Stateful Rule Designer

概要

Empowers security operations by providing expert guidance on creating sophisticated stateful rules within the LimaCharlie ecosystem. It helps users move beyond simple, isolated detections to identify complex attack patterns—such as multi-stage exploits, brute force attempts, and malicious process trees—by maintaining historical context and relational data across multiple events. The skill ensures high-performance detection by emphasizing early filtering and optimal use of stateful operators like with_child and with_descendant.

主な機能

• Advanced temporal correlation using with_child, with_descendant, and with_events operators
• Threshold-based detection using event counting over specific timeframes
• Guidance on performance optimization and efficient event filtering
• Stateful logic patterns for detecting multi-stage attack chains
• Implementation of parent-child and process tree relationship tracking
• 0 GitHub stars

ユースケース

• Identifying brute force attacks by counting failed login attempts within a time window
• Detecting Office documents spawning malicious shells or encoded PowerShell
• Monitoring for sophisticated lateral movement or process tree anomalies