hard20 pts · first answer countsdetection-engineeringalert-triage
Why a 99% accurate rule floods the SOC
A detection rule catches 99% of real attacks and wrongly flags 1% of normal events. The SIEM sees 1,000,000 events per day, of which 10 are real attacks. About what share of the alerts will be true positives?
Discussion 0
Join free to post in the discussion.
Related questions
- IOC vs IOACybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- What a Tier 1 SOC analyst doesCybersecurity Analyst
- Failed logons followed by successCybersecurity Analyst
- Suspicious process tree in EDRCybersecurity Analyst
- Reading the logon typeCybersecurity Analyst
- Triage an impossible travel alertCybersecurity Analyst