Rule tuner
Cut the noise without cutting the coverage
Paste a noisy alert, the rule behind it and some of the logs. We look for a narrow, defensible exclusion, show what it would hide, and refuse to hide anything that looks like an attack.
Runs only in your browser. What you paste or load here is never uploaded, saved, or sent anywhere. This page cannot make network requests at all, and it uses no cookies or storage. Reloading or closing the tab clears everything.
Read this first.
- Your logs stay in your browser, but they can still contain sensitive details. Use Replace my identifying values below. It swaps IP addresses for generic ones (like 192.0.2.1), emails for example.com and user folder names for USER1. Put your own values back before you use a rule.
- Tuning is not the same as fixing. Only exclude activity after you have searched historical data and confirmed what causes it. Rule text stays locked until you confirm that.
- Some activity must never be excluded, for example an Office program starting PowerShell. These are flagged and locked. See the examples at the bottom of the page.
- This is a helper, not a judge. It finds patterns in the sample you give it. A person has to check the result and test it.
1. Choose your rule format
Suggestions are written in this format. If yours is not listed, pick "Other" and translate the plain-language conditions.
2. Paste what you have
3. Replace my identifying values
Recommended before you share a screen or copy any output. Everything happens in this page.
Version-like numbers such as 1.2.3.4 can look like IP addresses and get replaced. Check the result looks right.
4. Analyze
When activity is abnormal
These patterns are the ones attackers rely on. They should be investigated, not tuned away.
When tuning is usually reasonable
Even then, check the history and keep the exclusion narrow.