Alert Fatigue Therapy: How to Write Detection Rules That Don't Suck

Join us for a meetup on November 19th in our Elastic office in Amsterdam! Doors open at 17.45 and the presentations begin at 18.00. Food, refreshments, and networking to follow. We wrap up around 20.00.

We are rating our talks as follows:
🟢 = Beginner content
🟡 = Intermediate content
🔵 = Expert content

Address: Elastic's office, Keizersgracht 281, 1016 ED Amsterdam

Agenda:
17.45: Doors open
18.00: Alert Fatigue Therapy: How to Write Detection Rules That Don’t Suck
18.45: Catching up with the latest Detection Engineering developments in Elastic Security
19.30: Networking, food with drinks
20.00: Wrap up

Talks:
Alert Fatigue Therapy: How to Write Detection Rules That Don’t Suck
🟡🔵 False positives burn out analysts. False negatives burn down businesses. Every detection rule we write lives in the tension between those two extremes.In this talk, we’ll explore what it really means to write great rules; not just technically sound ones, but sustainable ones. We’ll unpack how false positives and false negatives are inseparably linked, why perfect rules don’t exist, and how the smartest SOCs continuously tune, test, and enrich their analytics to reach higher fidelity.You’ll also see how data enrichment, contextual correlation, and thoughtful rule design can transform noisy detections into trusted analytics; improving not only accuracy, but also analyst confidence and overall SOC health. And of course, we’ll showcase some of these capabilities in action with Elastic Security!

Key Takeaways:
• Cut the noise: balance false positives and missed detections.
• Use context and enrichment to turn alerts into insights.
• Build rules that analysts trust — tested, tuned, and efficient.

Speaker: Marvin Ngoma, Principal Solutions Architect, Elastic

Catching up with the latest Detection Engineering developments in Elastic Security
🟢🟡 To be good at what you do you have to know your tools!
Have you ever tried to come up with a solution to a problem only to learn it was already solved in the tool you are using?
Let’s catch up on the past year of development in the Detection Engineering Experience space at Elastic and look at the crystal ball to foresee some of the future.

Key takeaways:

• Wholistic overview of elastic detection capabilities
• Highlights of the latest additions

Speaker: Kseniia Ignatovych, Senior Product Manager, Elastic Security