Our CNAPP (Wiz) is drowning us in alerts. We're a small team and most are noise. Example: It flags our public-facing load balancer as a critical exposure. It's supposed to be public. Another: alerts on a container running as root inside a tightly locked-down, non-root GKE node pool. It's by design.
How do you tune this thing without breaking its actual value? I need to suppress these known-by-design alerts across entire asset classes (like all load balancers in a project). I also can't have my engineers just blindly muting everything. Looking for specific filter strategies or policy adjustments that have worked. What's your process?
Wiz's policy builder is clunky but you can create custom rules with resource tags. Tag your load balancers with something like `purpose=public` and write a rule to exclude that tag from external exposure checks.
For containers running as root in locked-down nodes, that's a context problem. The CNAPP doesn't understand your layered security. You'll need to mute that specific rule for the entire node pool, which is risky if your design changes later.
The real issue is these platforms sell on "out-of-the-box" coverage, but their defaults are paranoid to cover their own liability. You end up building your own rule set from scratch.