Sudaroli Dhananjeyan

The Exclusion Ratchet: False-Positive Suppression Accumulates and Persists in Detection Rule Repositories

When a rule produces too many false alarms an analyst adds an exclusion, and the rule thereafter declines to alert in that circumstance. Each such decision is locally reasonable; what becomes of them collectively is not known. Recent longitudinal work established that curation does not converge, but measured restoratio...