THE FRAGILE BALANCE: ASSUMPTIONS, TUNING, AND TELEMETRY LIMITS IN DETECTION ENGINEERING

Summary from the TLDR InfoSec newsletter

When developing detection rules, assumptions are inevitably made that may lead to false positives. When tuning an alert for false positives, detection engineers may run up against telemetry limitations that force them to reconsider their initial assumptions. These limitations may lead the team to recreate the rule from a different data source, accept some amount of false positives, aggressively filter the rule and accept a certain amount of potential misses, or altogether scrap the rule.