Analysts in a SOC receive thousands of low-severity alerts per day and routinely miss the few that matter. Leadership wants fewer, higher-confidence items to investigate without turning off detections. Which approach addresses this?
Select an answer to reveal the explanation.
Short Explanation
Thousands of alerts is like a fire alarm that goes off every time someone makes toast. You don't rip out the alarm; you connect the clues and ask which room really has smoke. Correlation plus risk-based priority gives you a short list worth your time.
Full Explanation
Alert fatigue arises when detections generate high volumes of individually low-value alerts. Correlation groups related alerts by shared entities and time, such as the same user, host or indicator, into a single incident or investigation item, and risk-based prioritization scores those items using factors such as asset criticality, user privilege, detection confidence and the accumulation of suspicious activity. Analysts then work a short, ranked list while every underlying detection remains active and contributes evidence. Raising thresholds on every rule reduces volume by discarding detections indiscriminately and hides early-stage signals that only matter in combination. Hiring more analysts addresses symptoms, scales poorly, and still leaves people sorting noise without context. Routing low-severity alerts to an unreviewed queue is effectively disabling them, which contradicts the requirement and discards the evidence that correlation would combine. Exam caveat: platforms implement this differently, for example incident correlation and priority scoring in Cisco XDR or risk-based alerting in Splunk Enterprise Security, but the principle is the same. Operational check: compare daily items requiring analyst action before and after the change and confirm true-positive rates rise while detection coverage stays the same.