Question

A detection engineer wrote a YARA-L single-event rule that fires on any authenticated SSH login from an external IP to production hosts. The rule generates hundreds of alerts daily, and analysts confirm the overwhelming majority originate from a known, authorized third-party vulnerability scanning service whose source IPs change weekly but always resolve within a documented ASN. Which tuning approach best reduces false positives while preserving detection of genuinely anomalous external SSH logins?

Accepted Answer

Enrich the event with ASN context and exclude the scanner's documented ASN via a reference list referenced in the rule, so IP rotation does not require rule edits

Answer

Add a hardcoded list of the scanner's current IP addresses to the rule's condition using a 'not' clause, and update the rule each week when the IPs rotate

Answer

Raise the rule's severity threshold so that only high-volume login bursts trigger alerts, filtering out the scanner activity

Answer

Move the rule to TEST state so its detections no longer create alerts, then have analysts review the test results manually each morning