From Dev.to
My SOC triage model had 0 false escalations. On real alerts it had 39 out of 100.
On my test set the model got 55 out of 55 verdicts right, with zero false escalations. Then I gave it 100 real alerts from a Wazuh lab. It escalated 39 of them for nothing, and invented incidents that...