Ravi Sir's Cyber Security Cards › Interview Cards
What is alert fatigue and what do you do about it?
What is alert fatigue and what do you do about it? Alert fatigue is when too many low-value alerts train analysts to click “Close” without thinking. A noisy rule that fires 500 times a day (Example data) gets ignored, so a real one is missed. “I tune or add exceptions to noisy rules, and I document
Read card text
What this card says
Short answer
Alert fatigue is when too many low-value alerts train analysts to click “Close” without thinking.
Example
A noisy rule that fires 500 times a day (Example data) gets ignored, so a real one is missed.
Say it in the interview
“I tune or add exceptions to noisy rules, and I document why, with detection engineering.”
Why it matters
Fatigue causes missed real attacks, so reducing noise is a safety job.
Learn more in the lesson: 47.4 SOC Analyst Round – SIEM, Triage, MITRE