Every SIEM needs a full-time log babysitter, and that's fine by me

Saw a thread last week where folks were trashing their SIEM because it drowns them in false positives, but honestly my Sentinel setup has 3,000+ alerts a day and I just tune the same 12 rules over and over. Isn't the whole job about knowing your noise better than the vendor does, or are we all chasing some magic tool that never needs a human?

1 comments

1 Comment

nora_wells5820d ago

Oh boy, here we go again with the great SIEM existential crisis. Sounds like you found a system that works, so maybe stop overthinking it and go tune those rules.