Question

A SecOps analyst is triaging a case in Google SecOps that groups 40 alerts from a single detection rule. Investigation confirms all 40 alerts fired on a legitimate backup service account that authenticates from an unusual geographic region each night due to a recently migrated data center. The behavior is benign and expected to recur nightly. The analyst has confirmed this is a true false positive with the account owner. What is the most appropriate triage action to reduce recurring noise while preserving detection integrity for genuinely anomalous authentications?

Accepted Answer

Add a scoped rule exclusion (e.g., a reference list allowlist entry for the backup service account and the new data center region) referenced in the detection logic, then close the case documenting the tuning change.

Answer

Close the case as a false positive and take no further action, since documenting the closure reason is sufficient for future analysts.

Answer

Disable the detection rule entirely to stop the recurring alerts, then re-enable it after the data center migration stabilizes.

Answer

Lower the detection rule's severity so the alerts no longer generate cases, leaving the rule logic unchanged.