Loadingā¦
20
Every SIEM needs a full-time log babysitter, and that's fine by me
Saw a thread last week where folks were trashing their SIEM because it drowns them in false positives, but honestly my Sentinel setup has 3,000+ alerts a day and I just tune the same 12 rules over and over. Isn't the whole job about knowing your noise better than the vendor does, or are we all chasing some magic tool that never needs a human?
1 comments
Log in to join the discussion
Log In1 Comment
nora_wells582mo ago
Oh boy, here we go again with the great SIEM existential crisis. Sounds like you found a system that works, so maybe stop overthinking it and go tune those rules.
10