Detection tuning
Use this when an alert queue is too noisy to work, and the rules need tightening without quietly losing the detections that matter.
Done when
False positives are below the agreed threshold and every known true positive still fires.
The frozen window is replayed after every change: the targeted group is suppressed, the regression set is unchanged, and any change that costs a true positive is reverted rather than accepted.
The cycle
- 01Freeze a window of alerts and classify each one from evidence, keeping true positives as a regression set.
- 02Group false positives by shared cause rather than by rule.
- 03Change the rule as narrowly as the largest group’s cause allows.
- 04Replay the window: the group must be suppressed and every true positive must still fire.
- 05Repeat until precision clears the threshold with recall intact.
repeat from 01 while the evidence improves
Why it holds
Noisy detection fails in a specific way: people stop reading it. Tuning by intuition tends to silence whatever fired most recently, which is often the rule that works. Deciding each alert against evidence, and re-testing the true positives after every rule change, keeps precision improving without trading away recall.
Work only with [authorized detection platform and log sources] and only with the permissions you already hold. Do not disable a rule you cannot restore. Take a fixed window of alerts and freeze it. For each alert, decide from evidence whether it is a true positive, a false positive, or benign-but-expected activity, and record why. Keep the true positives as a regression set — they are what any change must continue to catch. Group the false positives by their shared cause: a legitimate service account, a scanner, a batch job, a misfiring field, a threshold set for a smaller system. Take the largest group and change the rule as narrowly as the cause allows — exclude that identity, that path, that user agent, that time window. Prefer a specific exclusion to a raised threshold, because a threshold silences the same behaviour at a different scale rather than the thing you actually meant to exclude. After each change, replay the frozen window. Confirm the group is suppressed and every alert in the regression set still fires. Revert the change if any true positive disappears — that is not tuning, that is losing coverage. Stop and ask before disabling a rule outright, changing anything tied to a compliance obligation, or excluding an identity you cannot account for. Finish when the remaining false-positive rate is below the agreed threshold and every true positive in the regression set still fires. Report the starting and ending precision, each rule change with its cause, and any alert group you deliberately left alone and why.
Scan
clean- Local rulesclean
- Trivyclean
- Cisco AI Defense Skill Scannerclean
1 informational
- NVIDIA SkillSpectorclean
score 0/100 · safe