Forty alerts a day

Medium · 20 points

A week of alert counts from four detection rules, with what each one turned out to be after review.

One of these rules is actively harmful: it is training whoever is on duty to close the queue without reading it. It is not simply the one that fires most — a rule can be busy and still earn its place.

Identify the rule that should be tuned by exclusion, and submit its id as the flag: skrd{RULE-000}.

Ask of each rule: of everything it fired on, how much was worth a human's attention?

Artefact

rule      fired  confirmed  benign cause
--------  -----  ---------  ---------------------------------------------
RULE-014     11         9   remote service creation by non-admin accounts
RULE-027    283         0   backup agent reading every share nightly
RULE-031     46        12   password sprays against the mail gateway
RULE-052      3         3   new local admin created outside change window

Hint

Two hundred and eighty-three fires, nothing confirmed, one known cause. Exclude that account on that host for that action — do not delete the rule.