Cutting SIEM noise without losing coverage
Professional work at a previous employer. The employer and internal details are left out.
As lead for SOC detection and response, I reworked SIEM detections and correlation logic, reducing alert volume by about 30% while keeping useful coverage and giving responders more context.
Approach
I found the noisiest rules through dashboards, starting with the highest volumes. Many of those alerts were false positives from the normal course of work, so I correlated them with normal work. I reduced the built-in rules that over-alerted. For detections that hadn't fired in 90 days, I found a way to test them, firing them intentionally where that was possible. I measured the change month over month on dashboards, by alert type and count.
Limit
The 30% is alert volume. It isn't a measure of detection quality on its own.
Related lab work
A detection tested for when it should fire and when it shouldn't, and checking test data against real events before turning a rule on.