Analysts are overwhelmed by low-value firewall 'allow' alerts and miss higher-severity events. Which monitoring improvement best restores focus on true threats?
Select an answer to reveal the explanation.
Short Explanation
If the smoke alarm chirps every time someone opens a door, nobody hears a real fire—tune the noisy firewall allows down so true threats stand out. Quarantine when it matters; do not page leadership for every allow.
Full Explanation
Alert tuning reduces false or low-value noise so analysts can respond to meaningful detections, and quarantine or related response actions can be applied when activity is confirmed malicious. Flooding inboxes or disabling ticketing worsens response quality. Effective 4.4 operations balance sensitivity with analyst capacity.