CCSE: CrowdStrike Certified SIEM Engineer

Question

As a Next-Gen SIEM Engineer, you are responsible for managing and tuning correlation rules to improve detection of potential security incidents. One correlation rule is designed to detect multiple failed login attempts followed by a successful login within a short time frame.

Which action would you take to tune this correlation rule to reduce false positives while preserving its effectiveness?

Explanation

Excluding verified trusted IP addresses creates a targeted exception for known benign sources while preserving detection of the suspicious sequence—multiple failed logins followed shortly by a successful login—from all other sources. Microsoft Sentinel guidance identifies specific IP addresses as common sources of false positives and supports excluding them directly in an analytics-rule query.

Learn more

Handle false positives in Microsoft Sentinel

CCSE: CrowdStrike Certified SIEM Engineer

AstroTutor

Notes

Readiness

QuestionQ27

Community Discussion