{"id":4789,"date":"2023-05-04T07:00:00","date_gmt":"2023-05-04T07:00:00","guid":{"rendered":"http:\/\/www.sumologic.com\/blog\/tuning-cloud-siem-machine-learning"},"modified":"2025-06-17T07:59:58","modified_gmt":"2025-06-17T15:59:58","slug":"tuning-cloud-siem-machine-learning","status":"publish","type":"blog","link":"https:\/\/www.sumologic.com\/blog\/tuning-cloud-siem-machine-learning","title":{"rendered":"Fine-tuning Cloud SIEM detections through machine learning"},"content":{"rendered":"\n
\n
\n
\n
\n
\"ML-powered<\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Security engineering teams spend hours every week tuning their security information and event management (SIEM)<\/a> systems to ensure that they are effective at detecting security threats and minimizing false positives. Such \u201ctuning tax\u201d is common as customers add new SIEM<\/a> rules to cope with rapidly changing threat landscape and attacker tactics and as their attack surface evolves through automated changes to their application and infrastructure stacks.<\/p>\n\n\n\n

Just as you would engage a personal trainer to get the best results for time spent at the gym, Insight Trainer learns from your Signals and Insights data to identify Tuning Expressions and adjustments to rule severities to optimize your Cloud SIEM<\/a> detections. With Insight Trainer, SOC teams can free themselves to focus on real threats by minimizing time spent investigating false positive Insights. <\/p>\n\n\n\n

A day in the life of a security engineer<\/strong><\/h2>\n\n\n\n

Many Sumo Logic customers divide responsibility between security\/detection engineers and the Security Operations Center (SOC) teams. The latter are the first-line responders for security incidents while the former administer and tune SIEM platforms like Sumo Logic for detection efficacy. <\/p>\n\n\n\n

A typical process for tuning SIEMs involves the following steps:
<\/p>\n\n\n\n

    \n
  1. \n\n\n\n

    Gather feedback from SOC teams. Many customers have weekly meetings between security engineers and SOC teams to assess the latest security findings including rules that seem to be noisy as they cause false alarms. <\/p>\n\n\n\n<\/li>\n

  2. \n\n\n\n

    Refine detection rules. Security\/detection engineers analyze Insights and Signals from noisy rules within Cloud SIEM and assess if known and trusted users (e.g. system administrators) or machines (e.g. instances created by trusted automation scripts) dominate false positives. <\/p>\n\n\n\n<\/li>\n

  3. \n\n\n\n

    Create Tuning Expressions that mute signals from these users or lower the severity or deactivate these rules. In any of these strategies, the impacted rules are expected to trigger fewer insights because Cloud SIEM\u2019s detection algorithm triggers Insights when the cumulative severity of rules triggered on an entity exceeds a threshold. <\/p>\n\n\n\n<\/li>\n

  4. \n\n\n\n

    Rinse and repeat the above process every week.<\/p>\n\n\n\n<\/li>\n<\/ol>\n\n\n\n

    Security engineers also assess new and emerging threat patterns from penetration testing or other means and add new detection rules, initially as prototype rules. A prototype rule generates Signals, but those Signals will not contribute to Insights. Running the rule as a prototype for a while allows you to determine whether the rule is too noisy and fires too many Signals. <\/p>\n\n\n\n

    Many inefficiencies are apparent in this process including
    <\/p>\n\n\n\n