Anthropic-Cybersecurity-Skills/skills/performing-false-positive-reduction-in-siem/references/standards.md

# Standards - False Positive Reduction in SIEM

## Detection Quality Metrics (Industry Standards)

| Metric | Excellent | Good | Needs Improvement | Critical |
|---|---|---|---|---|
| False Positive Rate | < 10% | 10-20% | 20-40% | > 40% |
| Rule Precision | > 0.90 | 0.80-0.90 | 0.60-0.80 | < 0.60 |
| Mean Triage Time | < 5 min | 5-10 min | 10-20 min | > 20 min |
| Alert-to-Incident Ratio | 1:5 | 1:10 | 1:20 | > 1:50 |

## Tuning Frameworks

### NIST Continuous Monitoring (SP 800-137)
- Requires regular assessment and adjustment of detection capabilities
- Defines metrics-based approach to monitoring effectiveness

### SANS Detection Maturity Model
- Level 1: Basic alerts with high FP rate
- Level 2: Tuned alerts with correlation
- Level 3: Behavioral analytics reducing noise
- Level 4: Automated tuning with ML feedback loops

## Allowlist Management Standards
- All exclusions require documented justification
- Expiry dates mandatory (90-day maximum default)
- Quarterly review of all active exclusions
- Approval from detection engineering lead required