A set of correlation searches are enabled at a new ES installation, and results are being monitored.
One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.
What is a solution for this issue?

Question

A set of correlation searches are enabled at a new ES installation, and results are being monitored.

One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.

What is a solution for this issue?

Felix Bourdier · Accepted Answer

Suppress notable events from that correlation search.

Felix Bourdier · Answer

Disable acceleration for the correlation search to reduce storage requirements.

Felix Bourdier · Answer

Modify the correlation schedule and sensitivity for your site.

Felix Bourdier · Answer

Change the correlation search's default status and severity.

List of questions