312-39V2: Certified SOC Analyst v2

Question

A company’s SIEM produces a large volume of alerts, overwhelming the SOC team with false positives and irrelevant notifications. This problem is reducing team efficiency because analysts struggle to identify real security incidents. To resolve it, the security team chooses to refine its approach by defining clear threat-detection scenarios aligned with its environment and risk profile. This approach is expected to improve detection accuracy and streamline incident response. Which process is the team implementing?

Explanation

SIEM Use Case Management defines, prioritizes, validates, and tunes threat-detection scenarios and rules according to organizational risks and the operating environment. This produces higher-quality alerts, reduces false positives and irrelevant notifications, and helps the SOC focus on genuine incidents.

Learn more

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ97

Community Discussion