One Missed Threat Per Week: The Risk of Ignoring Low-Severity Alerts

A systemic failure in modern SOC operations has been identified through the analysis of 25 million security alerts. According to The Hacker News, defenders have quietly institutionalized a practice of disregarding low-severity and informational alerts to manage overwhelming volumes of telemetry. This dataset, which includes 10 million monitored events across live enterprise environments, highlights a paradox: the data required to stop an APT is often collected but never reviewed.

The Technical Reality of Alert Fatigue

The volume of data generated by EDR and SIEM platforms has reached a point where manual review is impossible. Organizations frequently filter out anything below a ‘medium’ or ‘high’ CVSS score or severity rating to prevent analyst burnout. However, this study suggests that this filtering process is responsible for missing one verified threat per week. These missed threats are not mere noise; they are often the early stages of a Supply Chain Attack or a Phishing campaign that has successfully established a foothold.

To effectively reduce alert fatigue in enterprise SOC environments, teams must recognize that severity is not a proxy for risk. A single ‘informational’ alert—such as an unusual PowerShell execution or a rare network connection—might appear benign in isolation. When these events are contextually linked, they often reveal the TTP of a sophisticated actor performing reconnaissance.

Low-Severity Security Alert Correlation

The solution to this visibility gap is not to force analysts to manually review millions of logs, but to improve low-severity security alert correlation. By using automated playbooks and machine learning models, SOC teams can identify clusters of low-severity events that, when viewed together, indicate a high-probability IoC. This approach allows for detecting stealthy lateral movement via informational logs that would otherwise be ignored by standard filtering rules. For example, Lateral Movement often involves legitimate administrative tools which rarely trigger high-severity alarms but leave a trail of informational telemetry across multiple endpoints.

Rethinking Detection Engineering

Modern threat detection should align with the MITRE ATT&CK framework to ensure that even low-level activities, such as discovery and persistence, are captured in a meaningful way. If a CVE is exploited, the initial detection might only show an ‘informational’ crash or an unusual service start. Without a strategy to escalate these signals, the attacker can establish C2 communications and begin data exfiltration before the first ‘high’ severity alert is ever triggered.

Strategic Recommendations

• Baseline Normal Activity: Establish a granular baseline of ‘normal’ informational logs to make anomalies easier to programmatically identify.
• Heuristic Correlation: Configure SIEM rules to escalate the severity of an alert if multiple low-severity events occur on the same asset within a short timeframe.
• Focus on Behavior: Prioritize detections based on behavioral patterns rather than static severity scores provided by vendors.