Anthropic-Cybersecurity-Skills/skills/performing-false-positive-reduction-in-siem/references/workflows.md

# Workflows - False Positive Reduction

## Tuning Cycle
```
Identify Noisy Rules --> Analyze FP Root Causes --> Tune Rules -->
Validate with Testing --> Measure Improvement --> Report --> Repeat
```

## FP Analysis Categorization
| Category | Action | Example |
|---|---|---|
| Known benign | Add to allowlist | Vulnerability scanner IPs |
| Threshold too low | Raise threshold | Login failure count from 5 to 20 |
| Missing context | Add correlation | PowerShell + network = suspicious |
| Missing enrichment | Add lookup | Asset criticality context |
| Rule outdated | Rewrite or retire | Legacy detection no longer relevant |