Turning Alert Fatigue into Actionable Alerts

Hey everybody, I currently am a SIEM engineer working for a MSSP. We currently leverage a multi-tenant platform that has pre-built detections that leverage machine learning. Out of the box there are around 150 ish machine learning detections. We have also create custom detections for specific TTPs and audit items. Along with a large Splunk instance.

Our team is developing alert fatigue because of the pure volume of alerts. We are only generating actionable tickets from around 20 of the …

actionable alert alert fatigue alerts cybersecurity