https://blog.njerumtwaiti.com/tags/siem/ Recent content in Siem on Njeru Mtwaiti Hugo en Sat, 18 Oct 2025 00:00:00 +0000 https://blog.njerumtwaiti.com/posts/siem-tuning-from-the-field/ Sat, 18 Oct 2025 00:00:00 +0000 https://blog.njerumtwaiti.com/posts/siem-tuning-from-the-field/ <p>SIEM tuning is the SOC work nobody talks about because it&rsquo;s unglamorous. There&rsquo;s no clean exploit chain to demonstrate, no CVE to drop. It&rsquo;s the slow work of making your detection layer actually useful instead of a source of alert fatigue that trains analysts to ignore everything.</p> <p>These are notes from production — from real log sources, real false positive storms, and real threats that needed catching.</p> <h2 id="the-false-positive-problem"> The False Positive Problem <a class="heading-link" href="#the-false-positive-problem"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>A poorly tuned SIEM is worse than no SIEM. When analysts are triaging 500 alerts a day and 490 of them are junk, two things happen:</p>