Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
A large enterprise is struggling with a high volume of false positives from its Security Information and Event Management (SIEM) system, leading to alert fatigue among security analysts and delaying response to legitimate threats. The information security manager wants to improve the efficiency of threat detection and response. Which of the following actions should the manager prioritize?
- ATune SIEM correlation rules and baselines to reduce false positives.
- BIncrease the number of security analysts to handle the alert volume.
- CDeploy additional security tools to generate more diverse alerts.
- DDisable low-priority alerts to temporarily reduce the workload.
Show answer & explanationAnswer & explanation
Correct answer: A. Tune SIEM correlation rules and baselines to reduce false positives.
High false positives indicate that the SIEM correlation rules are not accurately distinguishing between normal and malicious activity. Tuning these rules and establishing accurate baselines will directly address the root cause of alert fatigue by reducing irrelevant alerts and allowing analysts to focus on legitimate threats, thereby improving efficiency.
Why the other options are wrong
- B. Increasing staff without addressing the root cause (false positives) is an inefficient and unsustainable solution.
- C. Deploying more tools without addressing existing false positives will likely exacerbate the alert fatigue problem.
- D. Disabling alerts without proper analysis could lead to missing legitimate threats, creating a greater risk.
SIEM Optimization
The process of refining Security Information and Event Management (SIEM) systems to improve their effectiveness, reduce false positives, and enhance threat detection and response.
- Involves rule tuning, baseline establishment, and data source integration.
- Aims to reduce alert fatigue.
- Essential for efficient security operations.
Memory trick: SIEM: Tune the noise, find the signal.