Open cardosec

Case 59F80A · Blue team / DFIR · L2 Practitioner

New Rule Floods the Queue

Practise as: Incident drill · InterviewLevel: L2 Practitioner

Live alertYou deployed a rule for encoded PowerShell yesterday. It has fired 4,100 times in 24 hours; spot checks show most come from the endpoint management agent running signed maintenance scripts. Analysts have started bulk-closing it.

Interview questionA detection you shipped is flooding the queue and analysts are ignoring it. What do you do?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Stop the damage: switch the rule to monitor-only or lower its severity, so real alerts are not buried while you fix it.
  2. Find the top contributors by parent process, signer, path and host, and confirm they are benign.
  3. Exclude narrowly: the management agent parent plus its signer and script path, never the whole host or all PowerShell.
  4. Re-test against known-bad samples so the exclusion did not create a blind spot, then redeploy and record why.

If the interviewer pushes back

  • An attacker learns about your exclusion. How could they abuse it, and how do you make that harder?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09