What kind of patterns can the FP Pattern Finder detect?

It identifies over 14 patterns including single-host concentration, temporal periodicity, identical command-lines, service account activity, and file hash repetition.

Can I review the rules before they are applied?

Absolutely. The workflow includes a mandatory human-in-the-loop phase where you must review investigation findings and select which rules to deploy.

Do I need an active LimaCharlie organization to use this?

Yes, this skill requires an Organization ID (OID) and established API access to the LimaCharlie platform to fetch and analyze detection data.

How does this skill prevent false negatives?

The skill enforces 'Narrow Rules Only' logic, requiring at least two specific conditions (like category and hostname) for every rule, and requires explicit user approval before any deployment.

Security FP Pattern Finder

Name: Security FP Pattern Finder
Author: refractionPOINT

$refractionPOINT$ byrefractionPOINT

•

安全与测试

Automates the identification and suppression of false positive security alerts through deterministic pattern analysis and surgical rule generation.

The FP Pattern Finder is a specialized security utility for the LimaCharlie ecosystem designed to combat alert fatigue. By analyzing historic detection data, the skill identifies recurring noise patterns—such as single-host concentrations, identical command-lines, and periodic service account activity. It goes beyond simple detection by spawning parallel investigation agents to validate findings, ensuring that generated suppression rules are narrow and highly specific. This prevents false negatives while significantly streamlining the tuning process for security analysts and SOC teams.

主要功能

01Automated parallel investigation of detected patterns to assess risk

02Detailed transparency reporting with evidence points and risk factors

03Support for 14+ distinct noise patterns including temporal and infrastructure-based triggers

04Deterministic pattern detection across historical LimaCharlie detection data

05Surgical FP rule generation using multi-condition AND logic

063 GitHub stars

使用场景

01Identifying misconfigured administrative tools or noisy developer environments

02Automated investigation of recurring security events across large-scale organizations

03Bulk-tuning security detections to reduce daily alert volume and noise

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add refractionpoint/lc-ai fp-pattern-finder

For use in Claude.ai and ChatGPT

Download Skill