HAVE YOU BEEN KEEPING UP WITH YOUR LOW CONFIDENCE DETECTIONS?

Summary from the TLDR InfoSec newsletter

Traditionally, detection engineering focuses on prioritizing high confidence, high severity alerts to not overwhelm SOC analysts. Teams should also utilize low-confidence alerts. These alerts can be useful to provide more context to the full cyber kill chain that attackers utilized and can also detect activity that may be relevant but did not trigger a high confidence, high severity alert.