I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that these events are noisy and create complacency where I need to see real events. I assume that most people are ignoring these events somehow. I have read online and all I can find is this
Judging from the above article , I see that this method is somewhat of a hack.
Here is what I am currently doing . I created two rules for Source of AlienVault and one for the Destination of AlienVault , then set them to No SIEM. Is this a sound practice?
Is it recommended to silence or mute AlienVault alerts?
What is a good or clean way to accomplish this?