Performing False Positive Reduction In Siem

Performing False Positive Reduction in SIEM

Overview

False positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.

When to Use

• When conducting security assessments that involve performing false positive reduction in siem
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Common Misconfigurations & Verification

• Tuning suppresses true positives: broadening a threshold (count > 5 → count > 20 AND unique_accounts > 3) or adding an allowlist entry can silence the real attack, not just noise. A low-and-slow brute force at 6 failures/account now slips under the floor. After every tuning change, replay a known-malicious sample (Atomic Red Team T1110.001) and confirm the rule still fires.
• Over-broad allowlists: allowlisting a whole src_ip range or a process_name with no scoping means an attacker operating from that range/binary is invisible. Scope exclusions to the narrowest tuple (host + account + process), require approved_by, and enforce an expiry_date — verify expired entries actually fall out of fp_allowlist.csv.
• Suppression vs deletion: suppressing at the notable layer while the underlying events still index is recoverable; dropping events at ingest is not. Confirm you're tuning the correlation search, not silently discarding source data needed for later hunts.
• Baseline built on dirty data: eventstats avg/stdev baselines computed over a window that already contained the attacker normalize the bad behavior away. Validate the baseline window is clean and that stdev isn't zero (which makes the 3*stdev gate fire on everything).
• Verify each change two ways: (1) FP rate for the rule drops on the next review cycle, and (2) detection coverage is unchanged — run the atomic test, confirm the notable appears within the search window, and document the before/after fp_rate and precision so a tuning that quietly broke detection is caught.

Prerequisites

• Familiarity with soc operations concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

False Positive Reduction Techniques

1. Identify the Noisiest Rules

# Splunk - Top 10 noisiest correlation searches
index=notable
| stats count by rule_name
| sort -count
| head 10
| eval pct=round(count / total * 100, 1)

# False positive rate per rule
index=notable
| stats count as total
    count(eval(status_label="Closed - False Positive")) as false_positives
    count(eval(status_label="Closed - True Positive")) as true_positives
    by rule_name
| eval fp_rate=round(false_positives / total * 100, 1)
| sort -fp_rate
| where total > 10

2. Threshold Tuning

# Before: Too sensitive - fires on 5 failed logins
index=wineventlog EventCode=4625
| stats count by src_ip
| where count > 5

# After: Tuned - requires 20+ failures across 3+ accounts in 10 minutes
index=wineventlog EventCode=4625
| bin _time span=10m
| stats count dc(TargetUserName) as unique_accounts by src_ip, _time
| where count > 20 AND unique_accounts > 3

3. Allowlist/Exclusion Management

# Create allowlist lookup for known benign sources
| inputlookup fp_allowlist.csv
| fields src_ip, reason, approved_by, expiry_date

# Apply allowlist in detection rule
index=wineventlog EventCode=4625
| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason
| where isnull(allowlisted_reason)
| stats count dc(TargetUserName) as unique_accounts by src_ip
| where count > 20 AND unique_accounts > 3

4. Correlation Enhancement

# Before: Single-event detection (noisy)
index=wineventlog EventCode=4688 New_Process_Name="*powershell.exe"
| eval severity="medium"

# After: Multi-signal correlation (precise)
index=wineventlog EventCode=4688 New_Process_Name="*powershell.exe"
| join src_ip type=left [
    search index=wineventlog EventCode=4625
    | stats count as failed_logins by src_ip
]
| join Computer type=left [
    search index=sysmon EventCode=3
    | stats dc(DestinationIp) as unique_external_connections by Computer
    | where unique_external_connections > 10
]
| where isnotnull(failed_logins) OR unique_external_connections > 10
| eval severity=case(
    failed_logins > 10 AND unique_external_connections > 10, "critical",
    failed_logins > 5 OR unique_external_connections > 5, "high",
    true(), "medium"
)

5. Time-Based Exclusions

# Exclude known maintenance windows
| eval hour=strftime(_time, "%H")
| eval day=strftime(_time, "%A")
| where NOT (hour >= "02" AND hour <= "04" AND day="Sunday")

# Exclude known batch job schedules
| lookup scheduled_tasks_allowlist process_name, schedule_time
    OUTPUT is_scheduled
| where isnull(is_scheduled)

6. Behavioral Baseline Integration

# Build baseline for user login patterns
index=wineventlog EventCode=4624
| bin _time span=1h
| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time
| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins
    avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts
    by TargetUserName
| where logins > (avg_logins + 3 * stdev_logins)
    OR unique_hosts > (avg_hosts + 3 * stdev_hosts)

7. Threat Intelligence Filtering

# Only alert when destination matches known threat intelligence
index=firewall action=allowed direction=outbound
| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence
| where isnotnull(threat_type) AND confidence > 70
# This eliminates FPs from flagging connections to benign IPs

Tuning Process Framework

Step 1: Identify (Weekly)

• Pull top 10 rules by alert volume
• Calculate FP rate for each
• Identify rules with FP rate > 30%

Step 2: Analyze (Weekly)

• Sample 20 false positives per rule
• Categorize root cause of each FP
• Identify common patterns

Step 3: Tune (Bi-weekly)

• Adjust thresholds based on baseline data
• Add allowlist entries for benign patterns
• Enhance correlation logic
• Add enrichment context

Step 4: Validate (Monthly)

• Run Atomic Red Team tests to verify true positives still trigger
• Calculate new FP rate after tuning
• Document tuning rationale
• Review with detection engineering team

Step 5: Report (Quarterly)

• FP reduction metrics per rule
• Overall alert volume trends
• Analyst productivity improvements
• Rules retired or replaced

Validation Testing

# Run Atomic Red Team test after tuning to confirm detection still works
# Example: Test brute force detection after threshold adjustment
Invoke-AtomicTest T1110.001 -TestNumbers 1

# Verify detection still triggers after tuning
index=notable rule_name="Brute Force Detection"
earliest=-24h
| stats count
| where count > 0

FP Reduction Metrics

References

• CyberSierra - Tune SIEM Alerts to Eliminate False Positives
• ConnectWise - 9 Ways to Eliminate SIEM False Positives
• Prophet Security - Alert Tuning Best Practices
• ManageEngine - Reducing SIEM Alert False Positives