نظام SIEM الذي يطلق إنذارات كاذبة باستمرار يُتجاهَل. نضبط سينتينل ليكون موثوقاً.

flowchart LR
    subgraph Sources
      CLOUD[Cloud Logs]
      EP[Endpoints]
      IDS[Identity]
      NETS[Network]
    end
    Sources --> ING[Sentinel Ingestion]
    ING --> RULES[Detection Rules]
    RULES -->|match| INC[Incident]
    INC --> SOAR[Automated Playbook]
    INC --> ANALYST[Analyst Review]
    RULES -. continuous tuning .-> RULES

flowchart LR
    subgraph Sources
      CLOUD[Cloud Logs]
      EP[Endpoints]
      IDS[Identity]
      NETS[Network]
    end
    Sources --> ING[Sentinel Ingestion - untuned]
    ING --> A1[Alert]
    ING --> A2[Alert]
    ING --> A3[Alert]
    ING --> A4[Alert]
    ING --> A5[Alert]
    ING --> A6[Alert]
    A1 --> FATIGUE[Analyst alert fatigue]
    A2 --> FATIGUE
    A3 --> FATIGUE
    A4 --> FATIGUE
    A5 --> FATIGUE
    A6 --> FATIGUE