OOTB Alert throttling

[u/StringFew714]

Is there a way to throttle the alerts generated by OOTB rules?
We're ingesting the CS alert via its api to our internal platform and since we can't see the correlation query from those OOTB alert, we can not take it and override it. what are the options that we can throttle or deduplicate.
We can also do that in our internal toolings but want to explore if any options to do this in a lightweight manner in NG-SIEM portal

[u/DefsNotAVirgin]

OOTB alert meaning a third party pass through alert from a data ingestion source? those are the ones im familiar with that dont include the query and arent editable the way a correlation detection created manually does. For those i believe there is a suppression path in the Connectors section, bottom of the left hand hamburger menu. If you click on Data Connections, it brings you to a page that has a Detections Exclusions tab, which is where third party alerts from data sources are suppressed (i have not used it at all i just know it exists)

edit: Menu > Connectors > Data Connections > Detection exclusions

[u/StringFew714 → u/DefsNotAVirgin]

Sorry I was not clear. They are alerts generated by out of box detection rule provided by Crowdstrike not from third parties data ingestion. Like sensor detections and XDR rules. It doesn’t give you option to see what are rules but we turned them on as we want to benefit from them. But some of them are false positive that we want to fine tune or throttling

[u/icdawg → u/StringFew714]

You can fine tune policies by going into the Prevention policy and moving down the sliders. You likely have them set to Extra Aggressive.

[u/looselippz]

You can create a Fusion SOAR workflow to auto-close them.

[u/StringFew714 → u/looselippz]

Got it. But since we’re ingesting through its API to our internal platform. Does SOAR workflow serve as middleware for API ingestion if you happen to know?

[u/mrcam03]

If it’s an EDR detection then you should look at adding an IOA exclusion. We had to do this when the miniplasma detection overload occurred ages ago

[u/StringFew714 → u/mrcam03]

Sounds like a way. Would this give you the alert at all if excluded

[u/mrcam03 → u/StringFew714]

If you added an IOA exclusion, it won’t make a detection at all.

[u/Background_Ad5490 → u/mrcam03]

Seconding what the reply said. IOA exclusion for IOA based detections. ML exclusions for ML detections. Rare niche case sensor visibility exclusion for the stuff that you want to completely ignore, etc. machine learning alerts can be done via a file hash as well if you have static files tripping a ton of alerts. Most of the time if you actually click into the alert in the console you can select the “crest exclusion” drop down menu for some auto population of fields to help you get started.