ManageEngine: Reducing Alert Fatigue with Smart Thresholds in Log360

Name: ManageEngine: Reducing Alert Fatigue with Smart Thresholds in Log360
Uploaded: 2026-07-25T15:33:15-04:00
Duration: 4 min 6 s
Description: Static thresholds often trigger false positives or miss stealthy attacks. Log360’s smart thresholds adapt based on real-time and historical data to detect true anomalies while filtering out noise. In this video, learn how to: Use smart thresholds to mo...

Manage Engine

07/25/2026

0 (0%)

Report Like Favorite

Transcript

Cyber threats are evolving constantly, with attack patterns shifting based on new vulnerabilities and tactics. So to stay ahead, analysts need timely and accurate alerts to remain aware of potential threats. However, static thresholds that trigger alerts based on a fixed limit often lead to false positives or missed threats. So a rigid threshold may fail to detect a slow, stealthy attack or trigger unnecessary alerts for normal fluctuations. And this is where adaptive or smart thresholds come in. So what are smart thresholds? Smart thresholds dynamically adjust alert conditions based on real-time analysis and historical data. And unlike static thresholds, they continuously learn from system activity, adapting to changes in user behavior, network traffic, and application usage. This approach enhances threat detection while reducing false positives and negatives. So here's how it works. The solution establishes a baseline of normal activity, adjusts dynamically to deviations, then detects anomalies against this baseline. It triggers alerts only when deviations indicate potential threats. It utilizes machine learning to recognize patterns. It then incorporates a feedback loop to refine accuracy over time. Now let me demonstrate this feature using Event Log Analyzer, which is also a component of Lock360. Account lockouts are a common occurrence in any organization, especially during periodic password update cycles. But during these windows, the number of failed login attempts can skyrocket, which overwhelm the security team with alerts that are mostly harmless. With Lock360's smart threshold feature, you can filter out these expected spikes and focus only on anomalies that truly need investigation. Now let me walk you through how to set it up. Go to the Alerts tab and click Add Alert Profile. Set the alert profile name as Abnormal Account Lockouts, or name it as you see it fit. Set the severity to Critical or Troubled, depending on your organization's risk policy. Choose the appropriate log source, then choose Account Lockout from the predefined alert criteria. This ensures the alert is tied to real-time account lockout events captured from SQL Server logs. Modify the alert message to provide more context, if needed. Now it's time to set the threshold. Instead of setting a fixed number of lockouts, select the Smart Threshold option. Lock360 will utilize machine learning to analyze historical account lockout patterns for each user and adjust the threshold dynamically. For example, if a user typically experiences 0-1 lockouts a month and suddenly hits 5 lockouts in 10 minutes, Lock360 will flag it. But if dozens of users are being locked out during a known password reset period, the system will adjust the threshold to allow for more lockouts, preventing a flood of alerts. You can specify the timeframe for monitoring, ensuring that Smart Threshold learns the baseline activity for that period. Finally, click Save Profile. Lock360 will now start learning from historical data, refining thresholds per user or peer group, and ensuring alerts are contextually relevant. By using Smart Thresholds during periods like organization-wide password resets, Lock360 ensures that your security team isn't bogged down by alert noise and instead remains focused on identifying real threats like targeted account compromise or insider misuse. If you'd like to know more about Lock360 and how it works, please contact our technical experts today.

TL;DR

Static thresholds in SIEM systems generate excessive false positives during normal events like password resets while missing slow, stealthy attacks that stay below fixed limits.
Log360's smart thresholds use machine learning to establish behavioral baselines per user or peer group, dynamically adjusting alert conditions based on real-time and historical activity patterns.
The feature filters out expected spikes during operational windows while flagging genuine anomalies, allowing security teams to focus on real threats like targeted account compromise rather than routine noise.

Summary

This demonstration showcases Log360's smart threshold feature, which addresses a critical challenge in security operations: alert fatigue caused by static threshold configurations. Traditional SIEM alerting relies on fixed limits that often generate false positives during normal operational events like password reset cycles, while simultaneously missing stealthy attacks that fall below arbitrary thresholds. Log360's adaptive approach uses machine learning to establish behavioral baselines for individual users and peer groups, dynamically adjusting alert conditions based on real-time analysis and historical patterns. The video walks through a practical implementation scenario focused on account lockout monitoring, demonstrating how to configure smart thresholds that distinguish between expected spikes during password update windows and genuine security anomalies requiring investigation. By continuously learning from system activity and incorporating feedback loops, the solution aims to reduce alert noise while improving detection accuracy for targeted account compromise and insider threats.

Chapters

0:00 - Introduction
0:47 - What Are Smart Thresholds
1:11 - How Smart Thresholds Work
1:34 - Product Demonstration

Key Quotes

0:29 "So a rigid threshold may fail to detect a slow, stealthy attack or trigger unnecessary alerts for normal fluctuations."
0:52 "Smart thresholds dynamically adjust alert conditions based on real-time analysis and historical data."
2:58 "For example, if a user typically experiences 0-1 lockouts a month and suddenly hits 5 lockouts in 10 minutes, Lock360 will flag it."

FAQ

How do smart thresholds differ from traditional static thresholds in SIEM alerting?

Smart thresholds dynamically adjust alert conditions based on real-time analysis and historical data, establishing behavioral baselines that adapt to normal fluctuations. Static thresholds use fixed limits that often trigger false positives during expected events or miss stealthy attacks that fall below arbitrary thresholds.

Categories:

» Data Protection

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

10/27/2026

11:00 AM

10/27/2026

Maximize the Value and Security of Your Microsoft Investment

https://www.truthinit.com/index.php/channel/2178/maximize-the-value-and-security-of-your-microsoft-investment/
10/27/2026

11:00 AM

10/27/2026

Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
10/27/2026

01:00 PM

10/27/2026

The HUMAN Experience: Real-Time Insights into Page Intelligence

https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
10/28/2026

01:00 AM

10/28/2026

Ensuring Universal AI Security Across the APAC Region

https://www.truthinit.com/index.php/channel/2125/ensuring-universal-ai-security-across-the-apac-region/
10/28/2026

06:00 AM

10/28/2026

EMEA: Ensuring Comprehensive AI Security Across All Fronts

https://www.truthinit.com/index.php/channel/2127/emea-ensuring-comprehensive-ai-security-across-all-fronts/
10/28/2026

01:00 PM

10/28/2026

Ensuring Comprehensive AI Security Across the Americas

https://www.truthinit.com/index.php/channel/2126/ensuring-comprehensive-ai-security-across-the-americas/
10/28/2026

01:00 PM

10/28/2026

EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
11/04/2026

11:00 AM

11/04/2026

Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions

https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
11/05/2026

02:00 PM

11/05/2026

HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
11/05/2026

02:00 PM

11/05/2026

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
11/10/2026

01:00 PM

11/10/2026

Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

https://www.truthinit.com/index.php/channel/2191/zendesk-from-ai-readiness-to-results-a-framework-for-transforming-it-service/
11/10/2026

01:00 PM

11/10/2026

Agentic Shopping Trends: Insights for the 2026 Holiday Season

https://www.truthinit.com/index.php/channel/2219/agentic-shopping-trends-insights-for-the-2026-holiday-season/
11/12/2026

01:00 PM

11/12/2026

Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
11/19/2026

01:00 PM

11/19/2026

Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/