R7 InsightIDR - need to create a report/dashboard for calculation of the false positive alerts

InsightIDR
1

Hi All,

Has any of you tried to prepare report or dashboard which will show you the amount of false positive alerts. We want to reduce the number the amount of the incoming alerts and focus more on the real threats.

Thanks for your recommendations!

Nadya

1 Like
2

Hi Nadya,
It may be possible to use the investigation audit log for this. Decisions/changes to investigations are logged here and you can use this audit data to build dashboards and reports. See screenshot for a vary basic example

Screenshot 2024-04-29 at 13.39.35
Screenshot 2024-04-29 at 13.39.352970Ă—1572 437 KB

3

Hi Daragh,
Thanks for you advice! Very much appreciated!
Take care.
Nadya

4

where(“action” = “INVESTIGATION_DISPOSITION_ADDED”) groupby(“service_info.new_disposition”)

Seems to be a good query to use, there you could build a Pie or Bar chart to see the percentage of Benign events compared to the Malicious ones for instance

5

Thanks! David!

6

I feel that’s a great suggestion

7

Is it possible to define MTTR metrics in the dashboard to calculate how much time it took to resolve the Incidents

8

Not currently, there are audit logs in log search but you can’t perform calculations like this without writing some kind of script to programmatically query the data