A security analyst is tuning a Suricata IDS and finds a single rule…

Question

A security analyst is tuning a Suricata IDS and finds a single rule generating 10,000 alerts per day, all of which are verified legitimate business traffic. What is the BEST approach to reduce alert noise while maintaining detection capability?

Accepted Answer

Create a suppression rule or threshold that exempts known-good source and destination pairs while retaining the alert for other traffic — Here's the deal — a is correct because suppression rules allow the analyst to whitelist known-good traffic (specific IPs, ports, or combinations) while preserving detection for the same signature against other traffic. C is wrong because deleting the rule eliminates detection of actual attacks in all contexts.

Answer

Raise the alert severity threshold globally across all rules

Answer

Delete the rule from the ruleset entirely to eliminate the noise

Answer

Disable all IDS rules in the affected traffic category until the noise is resolved

A security analyst is tuning a Suricata IDS and finds a single rule generating 10,000 alerts per day, all of which are verified legitimate business traffic. What is the BEST approach to reduce alert noise while maintaining detection capability?

Short Explanation and Infographic

Full Explanation