Tuning out the noise: alerting a small team can live with

The SANS 2025 SOC survey named false positives the number-one detection challenge (73% of teams), and industry State-of-the-SOC data put false positives near half of all alerts with analyst burnout above 70%. For a small agency team the problem is not too few alerts, it is too many bad ones.

1. The scale of the noise. What the 2025 numbers actually say about false positives and burnout.
2. Detection engineering as a discipline. Rules as code, versioned, tuned against outcomes.
3. ISM-relevant events first. Prioritising what an assessor and an incident actually care about.
4. The tuning loop. Every false positive generates a change; the loop closes.
5. Measuring signal quality. The metrics we hold ourselves to.

An operations and human-factors piece, not a threat piece. It reframes managed SIEM as signal quality rather than dashboards, which is exactly what a small, time-poor team needs. It also sets up the triage dive.

• Lead with the human and operational cost, not an attack.
• Show detection-as-code and the tuning loop as our method.
• Tie prioritisation to ISM-relevant events for the government reader.
• Keep it honest: good alerting is ongoing work, not a one-time install.