PDF p.328
In progress
Alert Tuning
Summary
PDF p.328Alert tuning is essential to reduce false positives and manage alert fatigue. It involves refining detection rules, redirecting alert floods, and using machine learning to optimize the alerting system.
In plain words
Supplementary — not from your PDFToo many alerts cause alert fatigue, and analysts miss real threats. Events can be log only, alert (for review) or alarm (critical). Watch the four outcomes: false positive (wasted time), false negative (a missed attack, the most dangerous), true positive and true negative. Tune by refining rules with more correlation factors, muting or downgrading noisy alerts, routing floods and infrastructure problems to the right teams, using analyst feedback, and applying SOAR and machine learning.
Detailed explanation
PDF p.328Criticality Levels
- Log Only: Event added to SIEM's database, not automatically classified.
- Alert: Listed on a dashboard for an agent to assess.
- Alarm: Automatically classified as critical, raising a priority alarm.
Challenges
- False Positives: Waste analysts' time and reduce productivity.
- Alert Fatigue: Analysts may miss high-impact alerts due to numerous low-priority alerts.
- False Negatives: System fails to generate alerts for malicious indicators, a serious security weakness.
- True Negatives: Events properly allowed by the system.
Techniques for Alert Tuning
-
1. Refining Detection Rules and Muting Alert Levels
- Adjust Parameters: Reduce multiple notifications by adding more correlation factors.
- Mute Alerts: Change to log-only status or reduce notification frequency.
-
2. Redirecting Sudden Alert "Floods"
- Dedicated Group: Assign to a dedicated agent or team to handle false positives.
-
3. Redirecting Infrastructure-Related Alerts
- Infrastructure Team: Manage misconfigurations causing high alert volumes.
-
4. Continuous Monitoring of Alert Volume and Analyst Feedback
- Manager Oversight: Monitor system and reduce alert sensitivity based on analyst feedback.
- SOAR Solutions: Automate rule processing.
-
5. Deploying Machine Learning (ML) Analysis
- Rapid Analysis: Monitor analyst responses and automatically tune rules to reduce false negatives without impacting true positives.
Important terms
taken from the text above- Log Only
- Event added to SIEM's database, not automatically classified.
- Alert
- Listed on a dashboard for an agent to assess.
- Alarm
- Automatically classified as critical, raising a priority alarm.
- False Positives
- Waste analysts' time and reduce productivity.
- Alert Fatigue
- Analysts may miss high-impact alerts due to numerous low-priority alerts.
- False Negatives
- System fails to generate alerts for malicious indicators, a serious security weakness.
- True Negatives
- Events properly allowed by the system.
- Adjust Parameters
- Reduce multiple notifications by adding more correlation factors.
- Mute Alerts
- Change to log-only status or reduce notification frequency.
- Dedicated Group
- Assign to a dedicated agent or team to handle false positives.
- Infrastructure Team
- Manage misconfigurations causing high alert volumes.
- Manager Oversight
- Monitor system and reduce alert sensitivity based on analyst feedback.
- SOAR Solutions
- Automate rule processing.
- Rapid Analysis
- Monitor analyst responses and automatically tune rules to reduce false negatives without impacting true positives.
ML Machine Learning
Examples & real-world scenarios
Supplementary — not from your PDF- Adding a condition so a rule fires only for privileged accounts.
- Downgrading a noisy informational rule to log only.
- Sending misconfiguration alerts to the infrastructure team.
Scenario
Analysts get 5,000 alerts a day, mostly from one misconfigured server. Fixing the server and tuning the rule cuts the noise, so real alerts get attention.
Common mistakes
Supplementary — not from your PDF- Muting a rule entirely instead of refining it.
- Tuning so aggressively that false negatives increase.
Practical skills
Supplementary — not from your PDF- Classify an outcome as TP, FP, TN or FN.
- Propose tuning for a noisy rule.
What I should remember
Key Points PDF p.328- Criticality Levels: Log only, alert, alarm.
- Challenges: False positives, alert fatigue, false negatives, true negatives.
-
Techniques
- Refining Rules: Adjust parameters, mute alerts.
- Redirecting Alerts: Dedicated groups for floods and infrastructure-related alerts.
- Continuous Monitoring: Manager oversight, SOAR solutions.
- Machine Learning: Automatic rule tuning.