Hey everyone, new to the SIEM side of things here. I'm coming from a basic DevOps monitoring background (Grafana/Prometheus) and now I'm helping manage our Exabeam deployment.
We're getting absolutely flooded with alerts, and most seem to be false positives. Like, "impossible travel" for service accounts that are used from fixed automation servers, or "rare process" for totally normal admin tools. It's drowning out real issues.
I'm trying to tune it. I looked at adjusting the risk scores for certain rules, but I'm not sure if that's the right approach. Has anyone gone through this? What's the best way to start cleaning this up without breaking the actual detection?
Here's an example of a rule condition I was looking at modifying:
```xml
...some logic...
50
```
Should I be lowering that score for specific user groups, or is it better to exclude certain accounts from the rule entirely? Any tips on a good workflow would be super helpful.