Most Alerts Are Noise. Design for That.

Ask most SOCs how many rules they run and you'll get a big, proud number. Ask them what percentage of those alerts get a real investigation and the number gets quiet fast. Somewhere between those two numbers is the actual state of your detection program, and it's usually worse than the rule count suggests.

Noise has a cost, and it isn't just annoyance

Every low-fidelity rule that fires without a real finding trains your analysts — correctly, rationally — to trust that rule a little less. Do it for months and you get habituation: the one time that rule fires on something real, it gets the same half-attention as the other 199 false positives that week. Alert fatigue isn't a discipline problem. It's a predictable consequence of a bad signal-to-noise ratio.

What to actually do about it

• Track false-positive rate per rule as a first-class metric, not an afterthought. If nobody owns that number, nobody's incentivized to fix it.
• Tune before you add. A new rule for a new technique is tempting. A rule that's already noisy and gets ignored is actively making detection worse, not neutral. Fix the ones you have before stacking more.
• Retire rules that don't earn their keep. If a rule hasn't produced a true positive in six months and nobody can explain what it's covering that nothing else does, it's a decoration, not a detection.
• Correlate instead of stacking. Five independent low-fidelity signals that each mean "maybe" can combine into one high-fidelity signal that means something. Alerting on each one separately just multiplies the noise. Correlation is also a data-hygiene problem: events from different sources carry timestamps in different formats (epoch seconds here, ISO there), and a Unix timestamp converter normalizes them so the correlation window in your rule is comparing the same instants — a surprising share of "correlation misses" are just unit mismatches.

And when a rule does fire on something real, score it the same way every time. A CVSS v3.1 calculator keeps severity ratings comparable across your team, so "critical" means the same thing to everyone triaging the queue — otherwise the severity label is just another kind of noise.

The goal was never more alerts. It was fewer alerts your analysts actually trust enough to act on the first time, every time.