Tuning

Tuning is adjusting a rule so it keeps its true positives and drops its false ones: tighter conditions, exclusions or thresholds. It is routine work, and it should be reviewed and versioned like any change. Some vendors now sell agents that propose tuning.

What Tuning means here

Tune against evidence: replay the change on history and compare alert counts.

Watch for over-tuning, where an exclusion hides a real attack. Record why each exclusion exists.

Example of Tuning in Anvilogic documentation

Anvilogic's detection engineering page pairs Tuning agents with the claim 80% Less alert noise with continuous tuning, a vendor claim with no method. anvilogic.com read 2026-11-03

Terms related to Tuning

• Noisy rule: A noisy rule fires far more often than it finds anything real, burying analysts in alerts.
• False positive rate: False positive rate is the share of a rule's alerts that turn out to be benign.
• Replay: Replay runs a rule over historical data to see what it would have alerted on.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.