detection-tuner

Alert fatigue from noisy detections can be reduced by analyzing detection patterns, identifying benign triggers, and deploying false positive rules to suppress them. This Skill identifies noisy alerts over a configurable time window, generates FP rules through a structured workflow, and requires human approval before deployment to ensure accuracy.

A false positive rule is a filter that suppresses benign alerts matching specific criteria, reducing noise without masking real threats. This Skill generates FP rules by analyzing detection data, testing rules against historical alerts, and applying only rules approved by operators to maintain detection integrity.

Tune detections by analyzing noisy alert patterns over a set time window, generating candidate FP rules, testing them against existing data, and submitting rules for operator review. This Skill enforces human-in-the-loop approval before any rules suppress live alerts, ensuring conservative filtering and transparent reporting.

Yes, this Skill applies a test-before-deploy approach: generated FP rules are evaluated against historical detection data within your configured time window to measure suppression impact. Testing happens before operator approval, so you see what alerts will be suppressed and why.

You need historical detection data spanning your analysis window (default 7 days). This Skill requires access to alert records including detection patterns, sources, and outcomes so it can identify noisy signals and generate rules with confidence.

Yes, this Skill is designed for detection data analysis across configurable time windows and scales to high-volume environments by prioritizing the noisiest patterns. Operator-in-the-loop approval and conservative filtering ensure quality rules even when processing large alert datasets.