Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Security OperationsHard
During a security audit, an external consultant identifies that the organization's SIEM system is generating an excessive number of low-priority alerts for legitimate network activity, leading to 'alert fatigue' among SOC analysts. This issue significantly reduces the team's ability to identify and respond to true threats effectively. Which SIEM process needs to be improved to address this problem?
- ALog Collection
- BReporting and Dashboards
- CEvent Correlation Rules
- DData Retention
Show answer & explanationAnswer & explanation
Correct answer: C. Event Correlation Rules
Excessive low-priority alerts for legitimate activity indicate that the SIEM's event correlation rules are not sufficiently refined to distinguish between normal and malicious events. Tuning these rules is crucial for reducing false positives and improving alert quality.
Why the other options are wrong
- A. Log collection issues might lead to missing alerts, not an excessive number of low-priority ones.
- B. Reporting and dashboards are for visualization and analysis of existing data, not for preventing alert fatigue from the source.
- D. Data retention policies affect how long data is stored, not the quality or quantity of real-time alerts.
SIEM Rule Optimization
The process of refining Security Information and Event Management (SIEM) correlation rules to reduce false positives, minimize alert fatigue, and improve the accuracy of threat detection.
- Involves adjusting thresholds and conditions.
- Aims to differentiate between normal and malicious events.
- Crucial for maintaining analyst effectiveness.
Memory trick: Too many alerts? Tune the rules!