Excessive alerts and false positives cause unnecessary strain and additional processing. You can modify rules and create exclusion lists to filter out alerts, allowing you to focus on the alerts that most need your attention. You can also disable a rule temporarily to stop matching events and alerting.
You can use all of the following methods to manage the volume and efficacy of alerts:
Use the following methods to tune the rule:
Change the severity of the rule. On the rules page, at the end of the rule row click More Options
.png "more-options.png")
> Edit, select a new severity from the menu, and click Save.Clone the rule and modify it as needed. For more information, see Clone a rule.
Disable the rule. For more information, see Enable or disable detection rules.
Add exclusion lists to the rule. For more information, see Create or modify exclusions.
Acknowledge alerts that the rule triggers as false positives. For more information, see Acknowledge alerts.
Suppress alerts that the rule triggers. For more information, see Suppress alerts.