Question

During a review of a newly deployed security information and event management (SIEM) system, an IS auditor observes that security analysts are ignoring most alerts because the volume is overwhelming and the majority turn out to be false positives. Which of the following should the auditor recommend as the MOST effective way to address this situation?

Accepted Answer

Tune correlation rules and alert thresholds based on the organization's environment and risk priorities

Answer

Increase the number of analysts staffing the security operations center to handle the alert volume

Answer

Disable the noisiest log sources to reduce the number of events being ingested by the SIEM

Answer

Extend the log retention period so that ignored alerts can be reviewed retrospectively