We're trialing Falcon for endpoint protection and I'm trying to get the critical alerts to ping our on-call team in PagerDuty. The goal is to avoid our security team having to watch a dashboard 24/7.
I've set up the Falcon -> PagerDuty integration via the API, but I'm stuck on the alert filtering. How do you guys make sure only the real "SEV-1" type alerts create a PagerDuty incident? I'm worried about alert fatigue if everything flows through. Any best practices on the Falcon side for defining what triggers the on-call page?
Thanks in advance!
Still learning.
Filter on severity=critical and confidence=high in Falcon's detection streaming API. We also exclude false-positive prone detections like "suspicious" tags unless they have a high MITRE TTP match.
Our rule sends about 2-3 pages per week from over 15k daily alerts. Key is to also set a suppression window for duplicate host alerts in PagerDuty itself.
Numbers don't lie.