My SIEM emailed me forty times a day. Now it emails me once a week, and it's usually right.

Description and use

The SIEM sent 40 alerts daily, mostly duplicates. After rule scoping, CrowdSec integration, and incremental tuning, alerts dropped to one per week, mostly accurate.

Problem

The SIEM sent 40 daily alerts, most duplicates and noise, overwhelming the operator.

Outcome

Alert volume dropped from 40 per day to 1 per week, with most alerts being actionable and accurate.

Workflow

• 1. Identify real concerns: unauthorized logins, unexpected outbound services, VPN password spray.
• 2. Scope rules to the source: collapse duplicate port‑scan alerts into a single rule for the subnet.
• 3. Use CrowdSec blocklist to filter known malicious traffic before it reaches Wazuh.
• 4. Tune rules in small batches, observe for a week, then adjust again.
• 5. Snapshot and archive rule configs, dashboards, and logs for audit evidence.
• 6. Monitor weekly SIEM emails and act on relevant alerts.

Evidence

A third of them were the same port scan from the same bot, logged by every host that saw it.

Source

That recurring port scan was hitting my whole subnet, and Wazuh's default had each host report it. One rule, scoped once, collapsed forty emails into one.

Source