The Exclusion Ratchet: False-Positive Suppression Accumulates and Persists in Detection Rule Repositories

Sudaroli Dhananjeyan, Kumaran U

When a rule produces too many false alarms an analyst adds an exclusion, and the rule thereafter declines to alert in that circumstance. Each such decision is locally reasonable; w…