Tuning a Noisy TIP Without Breaking Contracts
Your MSSP runs MISP for 30 clients. Twelve feeds push about 40,000 indicators per day into the shared instance. Two analysts spend three hours daily triaging; 92% of alerts generated from Feed 7 are false positives, but the contract requires ingestion until renewal in nine months. Duplicate indicators are common because feeds syndicate the same lists, and there is no aging: a 2019 IP is still marked active. The SIEM ingests all MISP events, producing 1,100 alerts per day with a 4% true-positive rate. Clients complain about noise, and one client's SOC has started ignoring MISP-sourced alerts. You cannot add headcount. You can change MISP settings, add enrichments, and adjust SIEM correlation. Leadership wants a 30-day improvement plan with measurable outcomes.
1. Design a tuning workflow using specific MISP and SIEM controls.
Read the worked answer
Start with an inventory mapping each feed to client sectors and intelligence requirements. In MISP, enable feed correlation, disable automatic publish to SIEM, apply taxonomies for Admiralty rating, confidence, and TLP, and use warninglists to filter known-good domains and IPs. Add indicator aging by type: IPs 30 days, domains 90 days, hashes 12 months, with sightings extending lifetime. Use MISP correlations and sightings to deduplicate syndicated lists. Quarantine Feed 7 in a tagged MISP event or separate sharing group so ingestion continues for contract compliance but does not auto-push to the SIEM. In the SIEM, require enrichment such as passive DNS or a reputation score and at least two independent sources or a high-confidence tag before alerting. Add allowlists and suppress low-confidence events. Route high-confidence indicators to blocking and low-confidence to hunting.
2. Quantify the expected alert reduction and define success metrics.
Read the worked answer
If Feed 7 contributes roughly half of the 40,000 daily indicators, keeping it out of auto-ingest removes about 20,000 indicators per day, of which 92% are false positives, so roughly 18,400 false indicators per day are suppressed. With 1,100 SIEM alerts per day at a 4% true-positive rate, there are about 44 true alerts. If Feed 7 drives most false positives, alert volume could fall to roughly 300 per day while retaining most true positives. Track baseline and 30-day trends for alert volume, true-positive rate, analyst triage hours, mean time to detect, count of client complaints, and feed precision. Set targets such as 50% alert reduction with no more than a 10% loss in confirmed true positives.
3. What would you do about Feed 7's contract and client communication?
Read the worked answer
Do not silently drop the feed. Document its precision against the contract, request false-positive samples and vendor precision metrics, and issue a performance cure notice. Keep ingestion in quarantine to preserve compliance while protecting the SIEM. Prepare for renegotiation or replacement at renewal. Communicate to clients with a monthly intelligence-quality dashboard showing reduced noise, retained detections, and any coverage gaps. Offer an opt-in high-confidence alert stream. Avoid blaming the vendor in client messaging; focus on measurable improvement and transparency.