97 Things Every Information Security Professional Should Know

Chapter 39. Managing Security Alert Fatigue

Julie Agnes Sparks

A Security Incident Response Team (SIRT) can be one of the greatest assets of a company, but it is also a finite resource. Each security engineer or analyst can only investigate a set number of alerts. Whenever these alerts stretch beyond what is feasible to investigate or the alerts are never indicators of actual security incidents, your team will become overwhelmed with alert fatigue. Alert fatigue can cause exhaustion, general demotivation, and lower quality investigations.

Often a security operations team’s success is measured by how many threat intelligence feeds they ingest, how many detections they write, and how many alerts they create. But why alert on every “bad” domain no matter how stale when you have folks who can write detections on malicious patterns specific to your environment? When the value of a security team is based on the volume, rather than the quality, of what they produce, that team is effectively set up for failure. Managers should instead design goals and metrics that encourage high-quality detections, and push back on requests that will increase noise such as ingesting everything into a security incident and event management (SIEM) tool. High-noise detections generate many false positives, which throttles the amount of bandwidth a security team has to investigate real incidents and improve ...