A SIEM correlation rule fires hundreds of alerts every day when the organization's authorized vulnerability scanner runs its scheduled scans. Analysts have started ignoring the rule's alerts entirely. Which action BEST addresses the problem while preserving detection of real attacks?

Alert tuning adjusts detection logic so alerts are meaningful. Here the false positives have a known, legitimate source: the authorized scanner, from specific addresses, on a predictable schedule. A narrowly scoped exclusion for that source, ideally constrained by address and time window, removes the noise while the rule continues to fire for the same behavior from any other origin. That restores analyst trust in the alert and reduces alert fatigue, which is itself a security risk because real events get dismissed. Disabling the rule eliminates the noise but also eliminates detection of genuine scanning or reconnaissance, trading a nuisance for a blind spot. Adding analysts spends money to review alerts that are already known to be benign, and it does not stop fatigue from setting in. Raising severity makes the problem worse by labeling known benign activity as more urgent, teaching analysts to ignore high-severity alerts too. Exam caveat: exclusions should be as specific as possible, because a broad allowlist can become an attacker's hiding place. Operational check: after tuning, run the scheduled scan and confirm no alerts fire for it, then simulate scanning from an unapproved host and confirm the rule still alerts.