How does it ensure that legitimate threats aren't suppressed?

The skill performs 'negative testing' by checking the proposed FP rule against other detections in the same category to ensure only the intended benign activity is filtered out.

Do I need special access to use this skill?

Yes, you must have a LimaCharlie account and initialize your context using the /init-lc command within the Claude Code environment.

What is the primary purpose of the Detection Tuner skill?

It is designed to help security operators identify noisy, repetitive alerts in LimaCharlie and create False Positive (FP) rules to suppress them, thereby reducing alert fatigue.

Can this skill deploy rules automatically?

No. The skill follows a strict human-in-the-loop principle, meaning every suppression rule must be tested and explicitly approved by a human operator before deployment.

What data does it use for analysis?

It typically analyzes detections from the past 7 days, grouping them by category, source rule, and hostname to identify high-frequency patterns.

Detection Tuner for LimaCharlie

Name: Detection Tuner for LimaCharlie
Author: refractionPOINT

byrefractionPOINT

•

安全与测试

Optimizes security operations by identifying noisy alerts and generating tested false-positive suppression rules for the LimaCharlie platform.

关于

The Detection Tuner skill empowers security analysts to combat alert fatigue within the LimaCharlie ecosystem by automating the identification of noisy, benign detections. It analyzes alert patterns over a 7-day window, identifies high-frequency activity, and guides the user through the process of generating and testing precise false-positive (FP) rules. With a mandatory human-in-the-loop workflow, the skill ensures that every suppression rule is validated against historical data and explicitly approved before deployment, maintaining a perfect balance between noise reduction and robust threat detection posture.

主要功能

Deep integration with LimaCharlie via specialized API executors
Pre-deployment validation testing against actual historical detections
Strict human-in-the-loop approval workflow for all rule changes
3 GitHub stars
Intelligent generation of targeted False Positive (FP) rules
Automated 7-day detection volume and pattern analysis

使用场景

Tuning out false positives generated by development or staging environment activity
Reducing alert fatigue by filtering known-safe automated software deployments
Suppressing high-volume benign alerts from trusted administrative tools like SCCM

关于

主要功能

Deep integration with LimaCharlie via specialized API executors
Pre-deployment validation testing against actual historical detections
Strict human-in-the-loop approval workflow for all rule changes
3 GitHub stars
Intelligent generation of targeted False Positive (FP) rules
Automated 7-day detection volume and pattern analysis

使用场景

Tuning out false positives generated by development or staging environment activity
Reducing alert fatigue by filtering known-safe automated software deployments
Suppressing high-volume benign alerts from trusted administrative tools like SCCM