Post by Simbian

Every false positive Defender fires is a small tax on your analysts' attention. Most SOCs pay that tax in the alerts they never investigate.