domains / families / security / implementing-alert-fatigue-reduction
implementing-alert-fatigue-reduction
separate
'Implements strategies to reduce SOC alert fatigue by tuning detection
When to use
- SOC analysts face more alerts than they can reasonably investigate (>100 alerts/analyst/shift)
- False positive rates exceed 70% on key detection rules
- True positives are being missed or dismissed due to alert volume
- Management reports declining analyst morale or increasing turnover related to workload
When not to use
- disabling detection rules without analysis
Skill page
Source