Noisy rule

A noisy rule fires far more often than it finds anything real, burying analysts in alerts. Causes include a loose condition, an unexpected data source or a benign process that looks like an attack. The fix is tuning, an exclusion or retirement, and the first step is knowing which rules are noisy.

What Noisy rule means here

Counting alerts per rule is the minimum. Better views also track how many alerts were closed as false positives. Few products compute that for you.

A rule can be noisy only in one environment, so measure on your own data before blaming the rule.

Example of Noisy rule in Google Security Operations documentation

Google's rule effectiveness page shows detection counts on a Rule Observability dashboard and suggests tuning a noisy rule with additional rule exclusions. docs.cloud.google.com read 2026-11-03

Terms related to Noisy rule

• Tuning: Tuning is adjusting a rule so it keeps its true positives and drops its false ones: tighter conditions, exclusions or thresholds.
• False positive rate: False positive rate is the share of a rule's alerts that turn out to be benign.
• Rule health: Rule health is whether a detection still runs, still sees its data and still earns its alerts.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.