implementing-alert-fatigue-reduction

Start by measuring alert volume and false positive rates per rule over 90 days, then tune the noisiest rules with targeted exclusions and convert threshold alerts into risk-based alerting. Track false positive rate and true positive recall weekly to confirm volume drops are not detection drops.

Risk-based alerting converts individual detections into risk score contributions against entities like source IPs or users, then generates a single alert only when cumulative risk crosses a threshold. This replaces many noisy threshold alerts with fewer high-context incidents.

Analyze false positive patterns by grouping on source, user, and command line to find dominant benign sources, then add narrow exclusions anchored on full path, signer, and user context. Re-run ATT&CK test cases after tuning to verify true positive detection still fires.

Common causes include scheduled risk searches not being enabled, misnamed risk_object or risk_score fields, missing write access to the risk index, or a threshold set above what real attacks accumulate. Verify the risk index returns data and backtest thresholds against past incidents.

Do not reduce alerts by disabling detection rules without analysis, since that creates detection blind spots. Any tuning must be validated against known-malicious samples and ATT&CK coverage to ensure true positive recall is maintained.