Tuning noisy rules

Use cases firing above your limit, the entities behind the noise, and the analyst time it costs. Open one in the Tuning Lab to test a change before it goes live.

Two rules cause 82% of the alerts, about 363 analyst hours a month.

1. Open a rule with Open Lab.
2. Under Who causes the alerts, switch off the accounts or hosts that are not a threat, and watch the volume change. Or click Ask Chuka to tune it.
3. Click Compare on the last 7 days to run the old and new search on real data.
4. Click Send for approval, or Apply if your team does not need a second approver.

Chuka found two service accounts behind most alerts and wrote the exclusion.