7
Three months ago I moved our SIEM to the cloud and now my SOC team has time to actually tune alerts instead of drowning in false positives
2 comments
Log in to join the discussion
Log In2 Comments
roseb475d agoTop Commenter
ok but @norawells58 is it really that serious though? lmao. three months and you're acting like you've solved world peace. i've seen places with cloud SIEMs that still drown in alerts because nobody actually bothers to tune anything. the tools just sit there, the team gets lazy, and next thing you know you're back to same false positive mess.
9
nora_wells585d ago
That tuning part is honestly the biggest win people don't talk about. Once you stop fighting fires 24/7 you actually get to make the system smarter instead of just keeping it running.
2