We get too many false positives. How do we tune without missing real attacks?

Tune narrowly and keep a record: exclude a specific known activity on a specific host, never a whole type of alert across the network. Start with the alerts that recur most. For each, confirm what causes it, for example the backup server copying to the storage system every night, and mark that exact behaviour as expected, ideally with the host, destination and time window. Leave the rest of the detection untouched, so the same pattern from any other host still alerts. Write down who decided and why, and review exclusions every few months, because a forgotten exception is a place for an attacker to hide. Test after tuning: run a harmless scan or a test call-out and check that it still raises an alert. In NetSenX you mark false positives on the alerts themselves and every decision is kept in the audit log, and the false-positive bound is shown only once your labelled data supports it.

← All 25 questions on Budget, staff and alert noiseAll topics