Hey everyone. First post here, and I'm coming at this from a data engineering angle, not pure security ops. But we ingest Cortex XDR alert logs into BigQuery for our SOC analysts' dashboards.
The default detection policies create *so much* volume. It feels like we're piping in mostly low-signal events. Example: our daily "Critical" alert count tripled, but the true positive rate dropped.
Has anyone else tuned this? I'm thinking:
* Export the default policy list to JSON (maybe via API)
* Use a Python script to categorize and filter
* Re-import only the high-fidelity policies
But I'm nervous about breaking something. Are there specific policy categories you turned off first? Or is there a better programmatic approach?
```python
# Pseudo-code of what I'm considering
# 1. Get all policies
# policies = requests.get(api_url, headers=headers).json()
# 2. Filter by criteria like 'severity' and 'tags'
# high_fidelity = [p for p in policies if p['severity'] == 'high' and 'false_positive' not in p['tags']]
# 3. Disable the rest...
```
Would love to hear how others manage this data firehose. 😅