A SOC team is overwhelmed with low-fidelity alerts and wants to reduce analyst fatigue while maintaining detection coverage. Which process improvement strategy most directly addresses this?

Question

Accepted Answer

A. Tuning SIEM correlation rules and implementing alert prioritization. Alert fatigue is addressed by tuning SIEM correlation rules to reduce false positives and implementing tiered alert prioritization so analysts focus on high-fidelity alerts first. The CySA+ process improvement objectives include streamlining operations and integrating tools. Simply adding analysts or licenses does not reduce noise; disabling rules eliminates coverage.

A SOC team is overwhelmed with low-fidelity alerts and wants to reduce analyst fatigue while maintaining detection coverage. Which process improvement strategy most directly addresses this?

Related Questions

Discussion