https://linuxeries.org/tags/detection/ Recent content in Detection on ShieldedBytes Hugo en Sun, 08 Nov 2026 11:25:34 +0200 https://linuxeries.org/post/2026-11-08-tuning-siem-correlation-rules-to-cut-false-po/ Sun, 08 Nov 2026 11:25:34 +0200 https://linuxeries.org/post/2026-11-08-tuning-siem-correlation-rules-to-cut-false-po/ <p>Azure AD sign‑in logs are a goldmine for detecting compromise, but they also flood SIEMs with benign events that look suspicious at first glance. A well‑tuned correlation rule set can reduce noise while preserving detection quality. Below is a step‑by‑step guide that balances precision, maintainability, and operational overhead.</p> <h3 id="1-start-with-a-baseline-understand-the-noise-profile">1. Start with a Baseline: Understand the Noise Profile</h3> <p>Before tweaking any rule, run a 30‑day baseline to capture normal activity. Export the raw sign‑in logs to a CSV or a SIEM table and run a quick aggregation:</p>