When should a detection be reviewed or retuned after deployment?

The correct answer is C. As defined by the established detection lifecycle. A detection should be reviewed or retuned as defined by the established detection lifecycle (DDLC). This ensures detections are consistently evaluated for accuracy, effectiveness, and alignment with evolving threats, rather than only reacting to false positives or inactivity.

Custom Content Development

Question

Options

AEvery 30 days.
BOnly if it has generated a large amount of false positives.
CAs defined by the established detection lifecycle.
DOnly if it hasn't generated a finding after several weeks.

How the community answered

(46 responses)

A
4% (2)
B
11% (5)
C
83% (38)
D
2% (1)

Explanation

A detection should be reviewed or retuned as defined by the established detection lifecycle (DDLC). This ensures detections are consistently evaluated for accuracy, effectiveness, and alignment with evolving threats, rather than only reacting to false positives or inactivity.

Topics

#detection lifecycle#detection tuning#false positive management#detection review cadence

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice