thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Tuning

Adjusting detection rules, thresholds and exclusions to improve alert accuracy.

Definition

Tuning reduces false positives by adding context, exclusions for known benign activity and appropriate thresholds, while avoiding blind spots that create false negatives. It is a continuous process informed by alert outcome metrics. Changes should be documented and reviewed.

Example

Excluding a vulnerability scanner's IP from the port-scan correlation rule.

Exam tip

Tuning is the first answer to "too many false positives" questions.

Related terms