All playbooks
Detection engineering · Detection engineers and SOC leads
Detection tuning and regression
Reduce known noise while protecting the behavior the rule should see.
Tune from reviewed events and an explicit cost of missing behavior, not from the desire for a quiet dashboard.
What this does not establish
- A noisy rule is not necessarily incorrect.
- A smaller result set does not prove improved detection quality.
- One benign event cannot justify an exclusion for every asset or user.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Define the noise and preserve the original rule.
Sample and label recent matches
- Record time window, count, reviewed sample and uncertainty.
- Separate benign activity from parser or mapping errors.