Monitoring dashboards generate thousands of alerts each day, most of which turn out to be false positives, and analysts have begun dismissing alerts without review. What should the security manager do to BEST address this?

Alert fatigue arises when the volume of low-value alerts exceeds the team's capacity to review them, so real indicators are lost in noise. Tuning detection rules removes known benign patterns, adjusts thresholds and adds context, while risk-based prioritization ensures that alerts involving critical assets or high-confidence indicators are reviewed first. Together they restore analyst attention to meaningful signals and make detection effectiveness measurable. Disabling all low-severity categories reduces volume bluntly but discards signals that can be early indicators of an intrusion, especially when correlated with other events; it trades one risk for another without analysis. A second monitoring platform doubles the volume to be reviewed and adds cost without addressing why the first platform generates so many false positives. Imposing a fixed closure time on every alert encourages analysts to close alerts quickly rather than correctly, which formalizes the behaviour that created the risk. Exam caveat: tuning is an ongoing process tied to changes in the environment and threats, not a one-time cleanup, and suppressions should be documented and approved. Operational check: track the false-positive rate, alert volume per analyst and time to triage, and review tuning changes on a defined cycle.