Google
PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #140
A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?
The correct answer is C. Apply risk-based alert scoring and entity correlation. Entity correlation and risk scoring preserve coverage while reducing noise.
Security Operations and SIEM Management
Question
A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?
Options
- ADisable medium-severity rules
- BIncrease alert thresholds globally
- CApply risk-based alert scoring and entity correlation
- DLimit alerts to business hours
How the community answered
(29 responses)- A14% (4)
- B3% (1)
- C76% (22)
- D7% (2)
Explanation
Entity correlation and risk scoring preserve coverage while reducing noise.
Topics
#alert fatigue#Chronicle SIEM#risk-based scoring#entity correlation
Community Discussion
No community discussion yet for this question.