A SIEM analyst notices that Windows Event ID 4624 (successful logon) with Logon Type 3 (network logon) is generated thousands of times per hour on file servers from service accounts. How should the analyst tune the SIEM to reduce alert noise without losing security value?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because context-aware suppression — excluding expected service account/server pairs during normal hours — eliminates noise while preserving detection fidelity for anomalous variants (after-hours, wrong source, wrong destination) that indicate credential misuse. A is wrong because deleting all logon events creates a blind spot for lateral movement detection.
Full explanation below image
Full Explanation
B is correct because context-aware suppression — excluding expected service account/server pairs during normal hours — eliminates noise while preserving detection fidelity for anomalous variants (after-hours, wrong source, wrong destination) that indicate credential misuse. A is wrong because deleting all logon events creates a blind spot for lateral movement detection. C is wrong because disabling auditing entirely removes the data source. D is wrong because extending the correlation window affects rule timing, not event volume or noise reduction.