4,200 Alerts, Six Analysts, One Missed Campaign
A six-person security operations team covers 07:00–19:00 on weekdays only. The SIEM produces roughly 4,200 alerts a week. A sampling review finds 11% are true positives, and about 60% of those come from three rules: impossible travel, mass file download, and one endpoint rule that fires on every scheduled backup. Median time to acknowledge is 26 hours, and analysts have begun bulk-closing tickets on Friday afternoons. Leadership's stated goal is zero missed criticals, and no new tooling budget has been approved. Last quarter a genuine credential-stuffing campaign against a customer portal was bulk-closed as a false positive; the affected customer discovered it three weeks later.
1. Where do you start, and what do you deliberately leave alone?
Read the worked answer
Start with the endpoint rule that fires on scheduled backups. It is the only candidate where you can remove volume without weakening detection, because the noise source is identifiable and provable: parent process, file path, and signer are known in advance, so suppression can be scoped tightly rather than by host.
The other two need prerequisites that do not exist yet. Impossible travel needs clean location context - VPN egress points and MDM-reported location - or you will suppress the true positives along with the noise. Mass file download needs a per-user baseline before thresholds mean anything.
Deliberately leave alone:
- The long tail of low-volume rules. Roughly 40% of true positives come from sources other than the big three; broad threshold-raising would cut into that first.
- Time-to-acknowledge as a project. Bulk Friday-afternoon closing is a symptom, not a cause; chasing the metric directly makes the symptom worse.
- Auto-closure of anything. That is precisely the failure that lost the credential-stuffing campaign.
Sequence the three rules by whether the noise source can be positively identified, not by which fires most.
2. The suppression you chose can itself be abused. What is the risk and how do you cap it?
Read the worked answer
The risk is that the backup schedule becomes a masquerade. An attacker who learns the allowlisted combination - same parent process, same path, same signer - inherits a blind spot, and the rule that would have caught them stays silent by design.
Capping it:
- Narrow the suppression to a tuple, not a host or a rule. Suppress only the specific signer + parent + path combination; any deviation still fires at full priority.
- Do not delete the signal - demote it. The events still land in a low-priority queue with a weekly sample review. Volume reduction is achieved by routing, not by amnesia.
- Alert on silence. Emit a health metric for the suppressed rule; if it stops matching entirely for longer than the backup cycle, that is itself a finding. Suppression that goes quiet is the strongest possible indicator of tampering.
- Watch the suppression counter as a security metric. A sudden rise in suppressed events outside scheduled windows is a detection, not a dashboard line.
Reversible, observable, and narrow beats permanent, quiet, and broad.
3. Leadership wants zero missed criticals. Frame the capacity reality and pick the one metric you would report.
Read the worked answer
Do the arithmetic out loud. 4,200 alerts a week at 11% precision is roughly 460 genuine events weekly across six analysts - about 77 real investigations per analyst per week, on top of the 3,700 they must clear to reach them. A 26-hour median acknowledgement means the worst-case dwell time is already over a day before anyone looks.
The honest position is that zero missed criticals is not achievable at this staffing level, and saying otherwise transfers the risk from the budget to the analyst. Offer tiered acknowledgement targets by severity instead of a blanket promise.
The metric to report: time-to-detect on seeded activity - inject known-malicious behaviour monthly across each log source and measure how long until it is acknowledged. That is the only number that answers the question leadership is actually asking, because it measures whether volume reduction hid something rather than assuming it did not.
Support it with percentage of alerts acknowledged within the severity-tiered target, reported for the 90th percentile and not the mean. Presenting alert counts or closure rates instead would let a worse outcome look like an improvement.