Building Correlation Rules That Don't Cry Wolf

If you have worked in a SOC for any length of time, you know the feeling. You open the alert queue on Monday morning and there are 1,800 alerts waiting. You spend the first two hours closing obvious f