Offense Volume Outruns Analyst Capacity
A 15-analyst SOC receives about 12,000 offenses per month. Seventy-eight percent come from one custom rule, Multiple Failed Logins, applied to 1,200 servers. Roughly 60% of the triggering events involve service accounts used by backup and monitoring tools. Analysts can realistically close 45 offenses per person per day, and the queue now lags by four days. The compliance team requires 12 months of log retention for PCI but has no requirement to retain offenses. The SOC manager proposes disabling the rule to clear the backlog. A security architect warns that doing so would remove the only detection for password spraying against domain controllers. You must decide within a week and show measurable improvement within 30 days.
1. Evaluate the proposal to disable the rule. What is the safer tuning sequence, and what evidence would justify each step?
Read the worked answer
Disabling the rule solves the queue symptom while removing coverage for a real technique, including low-and-slow spraying that may not trip account lockout. The safer sequence starts with measurement: quantify how many offenses involve service accounts, how many servers are domain controllers, and how many offenses contain successful logons after failures. Then separate the rule's scope: keep it on domain controllers and other high-value authentication servers, and reduce or threshold it elsewhere. Add a reference set or building block for approved service accounts, but pair that with a compensating control such as a quarterly review of the exception list and a separate low-threshold rule for those accounts. Only after those changes should you consider raising the threshold or changing offense per rule settings. Evidence for each step is a before-and-after count of true positives from a sample, not just a lower offense count; if the sample shows missed spraying, roll back.
2. Which metrics would you present after 30 days to show the tuning worked without hiding risk?
Read the worked answer
I would present a small set that separates volume from detection quality. First, total offenses per day and the queue age, to show capacity relief. Second, the share of offenses from Multiple Failed Logins and the share involving excepted service accounts, to prove the change targeted the actual noise. Third, a sampled true-positive rate: analysts review a random sample of remaining offenses and a sample of suppressed or lower-threshold activity, and report confirmed malicious or suspicious cases. Fourth, coverage evidence: at least one synthetic password-spray test against a domain controller still creates an offense within the expected interval. Fifth, analyst time per offense and backlog clearance. A falling offense count with no sampled true-positive check is not evidence of success; it may only prove the rule stopped reporting. Present the 30-day trend against a pre-change baseline and state explicitly which risks were accepted.
3. The SOC director wants a permanent exception for all service accounts. What conditions would you attach, and when would you refuse?
Read the worked answer
A permanent blanket exception is defensible only if the accounts are genuinely non-interactive, have tightly controlled credentials, and are covered by another detection path. I would require an owner and review date for every account, a restriction that the accounts cannot log on interactively where the platform allows it, monitoring of credential changes, and a separate detection for anomalous source hosts or unusual logon times. I would also require periodic sampling to confirm the exception list has not become a dumping ground. I would refuse if the accounts share passwords, if their logon patterns are indistinguishable from human use, or if the exception would also suppress domain controller activity. The deciding question is not whether backups generate failures; it is whether a compromised service account would still be detected by some other rule. If the answer is no, the exception is a blind spot, and the correct response is a lower-noise but still active rule, not suppression.