Question

Your SOC has deployed 40 YARA-L detection rules in Google SecOps over the past quarter. Leadership asks you to evaluate which rules are effective versus which are creating noise before the next tuning cycle. You pull metrics showing, per rule: alert volume, analyst dispositions (true positive / false positive / benign), and mean time to triage. Rule 'susp-oauth-grant' generated 900 alerts with a 2% true-positive rate, while rule 'admin-priv-escalation' generated 12 alerts with a 92% true-positive rate. Which approach best evaluates tool/rule effectiveness and identifies where coverage or tuning effort should go?

Accepted Answer

Prioritize tuning 'susp-oauth-grant' to raise precision (reduce false positives), retain 'admin-priv-escalation' as high-value, and correlate disposition data against known-threat coverage to expose gaps

Answer

Retire both rules, since one is too noisy and the other fires too rarely to justify maintenance overhead

Answer

Rank rules purely by alert volume and disable the top producers to immediately reduce analyst workload

Answer

Keep all rules unchanged and instead add more telemetry sources so the low-precision rule has more context