Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification…

Question

Exhibit

Options

• AIncrease the trigger count so that it identifies and reduces the count triggered by a particular
• BDisable the custom event handler because it is not working as expected.
• CDecrease the time range that the custom event handler covers during the attack.
• DIncrease the log field value so that it looks for more unique field values when it creates the

• A
  84% (26)
• B
  10% (3)
• C
  3% (1)
• D
  3% (1)

Explanation

The custom event handler SOC SMTP Enumeration Data Handler is generating many high- severity events in a short time frame. These events are all linked to Email Filter type logs, suggesting some sort of scanning or enumeration behavior (e.g., SMTP probing). Trigger Count is a threshold used in event handlers to control when an event should be If the event handler is set to trigger on every single matching log or minimal repetitions, it can flood the system with alerts. By increasing the trigger count, you make the handler: Wait for a larger number of matching events before triggering. This reduces noise, consolidates alerts, and better reflects significant incidents (e.g., sustained enumeration, not one-off probes).

No community discussion yet for this question.