Any rules which are producing a significant amount of risk, generally highlight an area to tune, consequently rules that are producing a small amount of risk provides possible scope for an increase. Tuning mechanisms in place here are 1 and 2 in the above list. 

Before we talk about false positives, let’s be clear what we mean by false positives in the way of risk based alerting. False positives are very rare in the world of Risk Based alerting, any behaviour in the environment that meets the criteria for the risk rule, is considered a positive event regardless of whether it is malicious or not. This is because Risk Based alerting is all about connecting behaviours across a number of different risk rules.  

However, if there are clear and distinct false positives, these could be excluded from the risk rule itself, for example if there’s a vulnerability scanner acting legitimately, consider excluding it from the risk rule. When doing this be as specific as possible, i.e. include the user, host and timeframe as part of the exclusion. An alternative to this could be to add that vulnerability scanner as a risk modifier and have that modifier significantly reduce the risk aligned to it. This is an example of using method 1 for tuning, by filtering out events at source. The second example of using method 1 for tuning occurs for risk rules where there is an element of aggregation involved, for example a risk rule which alerts should a user connect to X number of machines in a day, that threshold if unable to be dynamic based on the users role, could be increased if it is producing many alerts per day.

Once there are no clear repetitive false positives, the next step is to assess the levels of risk being aligned to the risk rule. If the risk rule is clearly producing a significant amount of risk, knowing that it is still very useful to know about, consider reducing the risk score that it generates, this could even be to 0 in certain situations, where you want to know about a specific event and include it in the number of mitre tactics/techniques involved but not alert strictly from any number of those events. 

From the getting started guide, you should have a matrix(table) of severity, confidence and risk score factors calculated for each risk rule. Consider further tuning of your confidence levels and aligned risk multipliers for them, with the goal of more refined base risk scores.

The second area is to search across your rules with context around the knowledge of the risk modifiers, the following search will show the count of risk rule matches for both additive and multiplicative risk rule modifiers. Be wary of modifiers that are very common, and consider being more specific if possible.