3 ms·
Most security tools are noise generators. Figure out how to separate the alerts that need attention from the rest.
by marcrosoft 3y ago
Most security tools are noise generators. Figure out how to separate the alerts that need attention from the rest.
- cookiengineer 3y agoThis is such an undervalued comment. Completely reflects my experience. Most dashboards have 99%+ noise that is useless from an operational perspective, and the inefficiency of Blueteam vs Redteam usually represents "how long until I can find the actual data points that matter" in the dashboards. (That was the reason I went with the peer-to-peer and SBOM idea, trying to reduce as much noise as possible)
- muttled 3y agoThis seems incentivized by marketing, as every security demo I've ever had has included something like "See? Our tool found 46,291 possibly critical issues in your environment" and then you drill into them later and they're relatively insignificant issues you'd fix in a perfect world with unlimited labor but drown out the actual things you actually want to know about right now. I think there's also incentive to upgrade the threat urgency on alerts to look like they're capturing more urgent threats.