Which two actions can an analyst take to reduce the number of false positive alerts generated by a custom BIOC? (Choose two.)

The correct answer is A. Implement a BIOC rule exception. C. Implement an alert exclusion rule. Implement a BIOC rule exception: This allows you to modify the specific BIOC rule logic to exclude certain behaviors, users, or files. It is the most surgical way to stop a specific rule from triggering when the activity is known to be benign. Implement an alert exclusion rule…

Alert Tuning and Optimization

Question

Options

AImplement a BIOC rule exception.
BImplement a global exception in the prevention profile.
CImplement an alert exclusion rule.
DImplement a shunt in a BIOC bypass rule.

How the community answered

(38 responses)

A
84% (32)
B
11% (4)
D
5% (2)

Explanation

Implement a BIOC rule exception: This allows you to modify the specific BIOC rule logic to exclude certain behaviors, users, or files. It is the most surgical way to stop a specific rule from triggering when the activity is known to be benign. Implement an alert exclusion rule: Alert exclusions allow you to suppress alerts based on specific criteria (like a specific command line or signer) after the detector has already matched the activity. This effectively hides the "noise" from the incident view without necessarily changing the underlying BIOC logic.

Topics

#BIOC Rules#False Positive Reduction#Alert Exclusion#Rule Exception

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice