A SIEM analyst notices that Windows Event ID 4624 (successful logon) with Logon Type 3 (network logon) is generated thousands of times per hour on file servers from service accounts. How should the analyst tune the SIEM to reduce alert noise without losing security value?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you should suppress known service account network logons to expected file servers during business hours, while still alerting when those accounts log in after hours, from unexpected source IPs, or to unexpected targets. That cuts the noise without blinding you to credential misuse.
Full Explanation
The correct approach is context-aware suppression: exclude expected service account/server pairs during normal hours, which eliminates noise while preserving detection fidelity for anomalous variants such as after-hours logons, wrong source, or wrong destination that indicate credential misuse. Deleting all 4624 events from the SIEM to reduce storage costs is wrong because deleting all logon events creates a blind spot for lateral movement detection. Disabling Windows Security Auditing on all file servers is wrong because disabling auditing entirely removes the data source. Increasing the SIEM correlation window from 5 minutes to 24 hours is wrong because extending the correlation window affects rule timing, not event volume or noise reduction.