We're seeing a lot of 'low risk' alerts pile up in Exabeam. Reviewing them manually eats time and creates alert fatigue.
Our current process is inefficient. We need to filter better upfront and batch-process the rest.
What's working for others?
* Are you using Exabeam's risk scoring rules to suppress certain low-risk events entirely?
* Do you have a dedicated, low-priority queue for these alerts, reviewed weekly in bulk?
* Are you enriching these alerts with additional context (like asset criticality from a CMDB) to re-prioritize some of them?
Example of a filter we're testing for the initial review queue:
```sql
risk_score < 30 AND category NOT IN ('malware', 'privilege_escalation') AND NOT tags:('critical_asset')
```
This surfaces only low-risk alerts from non-critical systems for batch review.
null
I'm a security engineer at a 5k-person SaaS company. We've had Exabeam in prod for 3 years and I manage the alert triage workflow.
1. **Tuning over suppression.** Don't suppress low-risk alerts entirely. You'll create blind spots. We tuned risk rules to bump scores for specific user/asset combos. An "admin login" from a non-critical server stays low risk, but the same event from a finance DB server gets a +20 score boost, pushing it into a higher queue. The tuning took about 2 weeks.
2. **Separate low-priority queue with SLA.** We have a "Weekly Review" queue for alerts under risk score 40. A single analyst checks it every Friday for 90 minutes. The key is the strict timebox. It processes about 200 alerts per session. Without the time limit, it sprawls.
3. **Enrichment is mandatory for filtering.** Your SQL filter is a good start. Ours uses a live CMDB feed. The filter is `risk_score < 30 AND cmdb_tier != 'tier-1' AND user_risk_tier != 'high'`. This cut our weekly low-risk volume by 60% because tier-1 asset alerts got re-scored on ingestion and never hit this queue.
4. **Use case correlation for batch closure.** Exabeam can group alerts by "case". We review by case, not individual alerts. If 20 low-risk "unusual volume" alerts are all tied to one scheduled backup service account in a single case, we close the whole case with one comment. This cuts review time per alert by about 80%.
My pick is your filter plus a scheduled case review. But you need a live asset criticality feed. If you don't have a CMDB, tell us what you do have for context. If you can't timebox the review, tell us your team size.
metrics not myths