An excessive number of false positives indicates that the security monitoring tool's detection rules are too sensitive for the organization's specific operational environment. The most direct and effective method to optimize the process is to tune the system by changing the reporting thresholds or adjusting the logic of the correlation rules. This process, often referred to as "baselining" or "tuning," helps the system better distinguish between normal network/system activity and actual malicious events. Adjusting thresholds reduces alert fatigue and allows security analysts to focus their efforts on investigating genuine threats, thereby improving the overall efficiency and effectiveness of the security monitoring function.

A. Report only critical alerts: This is a filtering action that masks the underlying problem of poor tuning and can lead to missing precursor events that are part of a larger attack.

C. Reconfigure log recording: This alters the data being collected, not the analysis of that data. The issue lies with the analysis rules, not necessarily the logs themselves.

D. Monitor incidents in a specific time frame: This creates significant and unacceptable security blind spots, as attackers do not adhere to a schedule.

---

1. ISACA

CISM Review Manual

15th Edition. Domain 4: Information Security Incident Management. The manual emphasizes that a key part of the detection and analysis phase of incident management is the continuous tuning of detection systems. It states that security events must be analyzed against predefined thresholds and baselines to determine if they constitute an incident. An excess of false positives is a clear indicator that these thresholds require adjustment. (Specifically

see the sections covering "Incident Detection and Analysis Tools and Techniques").

2. NIST Special Publication 800-137

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. Section 3.3

"Analyze

" discusses the analysis of security-related information. It notes that organizations define monitoring frequencies and analysis triggers/thresholds. The document states

"Analysis of the data collected may trigger an alert to the appropriate organizational officials for a response... Triggers can be event-driven

query-driven

or based on a specific time." Adjusting these thresholds is the primary mechanism for controlling alert volume. (Page 19

Section 3.3).

3. NIST Special Publication 800-92

Guide to Computer Security Log Management. Section 4.3.2

"Log Analysis Methods and Techniques

" discusses how automated analysis tools use correlation rules and thresholds. It implicitly supports the need for tuning

stating

"Organizations should test their log analysis capabilities to ensure that they can identify events of interest in a timely and accurate manner

" which includes minimizing false positives by adjusting these parameters.