Your SOC doesn't need more alerts, it needs fewer
A SIEM firing 4,000 alerts a day isn't monitoring — it's producing noise someone has to ignore in order to work. And what gets ignored by habit also gets ignored on the day it matters.
The first metric we ask for when reviewing a SOC is not rule coverage or retention. It is how many alerts arrive per shift, and how many are closed as false positives.
Once that second figure goes past 90%, detection is no longer the problem. The team has learned to close without looking, and that habit does not distinguish a useless alert from a good one.
The real cost of a noisy alert
It is not the minute it takes to close. It is that it degrades trust in everything else. An analyst who dismissed two hundred identical alerts this week will dismiss the two hundred and first without reading it — and will be right 99.5% of the time.
A rule that generates false positives is not a safety net. It is training to ignore.
Tuning is not muting
The temptation is to silence. But a rule muted without a record is a coverage gap nobody remembers. Every suppression should be written down: what is suppressed, why, who approved it, and when it gets reviewed.
Want us to look at your numbers? Let's talk.
Notas escritas a varias manos por quienes están en los proyectos. Si algo de acá te sirve o te parece discutible, escríbenos.