Tuning Without Opening a Blind Spot
What is it?
Tuning is reducing a detection's false positives on purpose. The senior skill is doing it narrowly: excluding a specific benign cause (exclusion) or muting a specific known-benign alert instance (suppression), without widening the hole so far that the attacker fits through it.
Why it matters
Careless tuning is how real intrusions get missed by rules that were 'working'. 'Exclude all activity from the admin group' silences the noise — and blinds you to an attacker who compromised an admin. Every exclusion is a hole; a senior analyst makes it exactly big enough for the benign cause and no bigger.
Where you see it
In the rule's exclusion clauses, in suppression lists tied to a ticket and an expiry, and in threshold values ('alert on ≥ N in M minutes'). Each is a knob that trades precision for recall.
What normal looks like
A good exclusion is narrow and justified: 'exclude vendor-backup.exe reading these two paths, signed by <cert>, ticket #123'. It removes one benign cause and documents why.
What suspicious looks like
A broad exclusion by identity or location ('anything from the SOC subnet', 'any admin account') or a threshold raised so high the technique never trips it — noise gone, and a blind spot created.
How analysts investigate
Find the exact benign cause of the false positives. Exclude that cause by its most specific stable property (signer + path), not by identity or subnet. Prefer time-boxed suppression for one-off known-benign bursts. After tuning, re-ask: what real attack would this exclusion now let through?
Common beginner mistakes
- Excluding by identity or subnet ('ignore admins', 'ignore the jump host') — the exact places attackers want to be.
- Raising a threshold to kill noise until the technique's real volume no longer trips it.
Suppression vs exclusion vs threshold
- Exclusion — a permanent rule change removing a benign CAUSE (narrow: signer + path). It is a standing hole; make it minimal.
- Suppression — muting a specific known-benign alert instance, ideally time-boxed with a ticket. Reversible; for one-offs.
- Threshold — 'alert on ≥ N in M minutes'. Cuts low-volume noise but blinds you to low-and-slow technique below N.
Worked example. The LSASS-read rule from Module 4.1 fires 40 times a day — all from one signed EDR-support tool reading LSASS legitimately. Bad tuning: 'exclude the admin group' (now any compromised admin dumps credentials invisibly). Good tuning: 'exclude image = C:\Program Files\Vendor\edrhelper.exe AND signer = <vendor cert> AND access mask = 0x1010'. That removes exactly the benign cause; an attacker's tool with a different signer or a broader access mask still fires. Then you re-ask the blind-spot question — and confirm the exclusion cannot be trivially imitated.
Quick check
A rule is noisy because one signed backup agent triggers it nightly. Which tuning keeps the blind spot smallest?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.