Tell me about a time you improved the SOC’s detection or response capability (for example, by tuning SIEM rules, automating playbooks, or refining runbooks). What was the problem, what specific changes did you implement, and how did you measure the impact on alert quality, MTTR, or analyst workload?

Question

VirtualInterview.AI · Accepted Answer

At my last company, our SOC was drowning in noisy alerts — roughly 2,500 SIEM alerts per day for a three-analyst team. Our Tier 1 folks were spending most of their shift closing obvious false positives from endpoint and email rules. I pulled 90 days of SIEM data and mapped the top 20 alert types by volume and closure reason. We saw that three rules accounted for about 45% of volume with a \u003e95% false positive rate.

I worked with the IR lead to add better whitelisting (approved admin tools, known vulnerability scanners), tightened thresholds, and added correlation with EDR signals so we only fired when multiple indicators lined up. In parallel, I built a simple SOAR playbook to auto-close a narrow set of well-understood benign alerts.

Within six weeks, total alert volume dropped by ~55%, false positives on those rules fell below 20%, and average MTTR for real incidents improved from 3.5 hours to about 1.8 hours because analysts could finally focus on meaningful alerts.

Sample Answer

Keywords