Question

A SOC team receives over 4,000 alerts per day from a rule that flags any outbound connection to a newly-registered domain. Analysts report severe alert fatigue, and a genuine command-and-control beacon was recently missed because it was buried among benign marketing and CDN domains. Leadership demands a fix that preserves detection of malicious beaconing while reducing analyst workload. Which approach best addresses the root problem?

Accepted Answer

Enrich the rule with contextual data (asset criticality, domain reputation, JA3/beacon periodicity) and apply risk-based scoring so only high-fidelity aggregated detections generate analyst-actionable alerts

Answer

Disable the newly-registered-domain rule entirely and rely on the EDR agent to detect any post-exploitation activity on endpoints

Answer

Increase the alert threshold so the rule only fires after 500 connections to newly-registered domains occur within one hour

Answer

Forward all newly-registered-domain alerts directly to a ticketing queue and hire additional tier-1 analysts to triage the higher volume