Which of the following can help you eliminate the burden of investigating false positives?

False positives are alerts on benign activity, and investigating them consumes valuable analyst time. Ingesting context data is the most effective way to reduce this burden. Context enriches raw event data with information such as asset criticality (e.g., is this a critical server?), user identity and role (is this a system administrator?), vulnerability scan results (is the targeted asset vulnerable?), and threat intelligence (is the source IP known-malicious?). This enrichment allows a SIEM or other security platform to more accurately assess risk, correlate events, and automatically filter or de-prioritize alerts that are benign within that specific context.

A. Keeping default rules typically increases false positives because they are not tuned for the specific operational environment.
B. Simply not trusting devices is a mindset, not a solution; it does not reduce the number of alerts that must be triaged.
C. Treating every alert as high-level would dramatically increase the investigation burden, leading to analyst burnout and alert fatigue.

1. National Institute of Standards and Technology (NIST). (2017). NIST Interagency Report 8194: Security Information and Event Management (SIEM) Implementations. Section 4.2, "Adding Context to Events," states, "Adding context to events can help analysts better understand the significance of an event... This can help reduce false positives."

2. Casola, V., De Benedictis, A., Rak, M., & Villano, U. (2018). A novel approach for security information and event management in the cloud. In Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES 2018). Article 58, Section 3. This academic paper discusses the need for context-aware SIEMs, stating that context information is "fundamental to reduce the number of false positives." DOI: https://doi.org/10.1145/3230833.3233277