Lesson 3.14: False positives and tuning
A detection that fires constantly on harmless things trains analysts to ignore it, and then the real alert gets ignored too. That's alert fatigue, and the cure is tuning: measuring how often each rule is right, finding the specific causes of its false positives, and removing exactly those, without removing the attacks. In the lab you use thirty days of analyst verdicts to rank Northwind's rules by false positives, find that two sources cause almost all the noise of the failed-logon rule, write narrow exceptions, and prove no true positive was lost.
16 min
You will learn to
- Explain alert fatigue
- Measure true and false positives per rule
- Find the specific causes of false positives
- Write narrow, documented exceptions
- Verify that tuning loses no true positives
Key terms
- Alert fatigue
- When so many alerts are false that analysts stop paying attention.
- Precision
- The share of a rule's alerts that are true positives: TP / (TP + FP).
- Exception / allowlist
- A documented condition under which a rule should not alert.
- Tuning
- Adjusting a detection to remove false positives without losing true positives.
← Broken access control and IDOR · All lessons · Encrypting files with AES →