Helping SOC Analysts Handle Fewer, Higher-Value Security Alerts at Microsoft

How would you reduce alert fatigue for the security analysts who work in Microsoft's OneSOC? Alert fatigue here means analysts receive more alerts than they can investigate carefully, so real threats risk being missed or handled late. ```hint Trace one alert's life Follow a single alert from the rule that fires it to the moment an analyst closes it, and ask where along that path the noise is created and where analyst time is lost. ``` ### Clarifying Questions - Is OneSOC the team protecting Microsoft's own systems, or a product that customers' security teams use? - Where does the fatigue show up most: false positives, many alerts for one incident, poor prioritization, or slow investigation of each alert? - Which analysts are the focus: first-line triage analysts, senior incident responders, or the detection engineers who write the rules? - May automation close or suppress alerts on its own, or must a person confirm every closure? ### What a Strong Answer Covers - A precise definition of alert fatigue and its root causes, separating noisy detections, duplicates, missing context and weak prioritization - A choice of which analyst and which stage of the alert's life to target first, with the reasoning - Concrete, prioritized solutions, including where AI helps and where it should not act alone - Metrics that pair analyst workload with security outcomes, so cutting alerts never hides missed attacks - Risks specific to security: suppressed true positives, attacker evasion, over-trust in automation, and auditability ### Follow-up Questions - After launch, alerts per analyst fall sharply, but a real intrusion was auto-closed as benign. How do you respond, and what do you change? - How would you measure missed attacks when, by definition, you do not see them? - Detection engineers resist tuning down their rules. How do you get them on board?