Tuning rules is an important component to maintaining a manageable flow of alerts. This allows security operation center analysts to make best use of their time by not having to deal with an excessive number of alerts. This section discusses several rule tuning methods that can be used to get more value and achieve a more favorable signal to noise ratio with Trellix Rules.
Important
Some Trellix rules contain logic referencing lists, which you must build. If the lists are not populated, the rule may not function as intended or may not work at all. For more information, see Default lists.