KQL - Microsoft Sentinel Noisy Rule Tuning Advisor

Udi B@Udi

•updated Aug 20, 2026•6•0•10

Finds Microsoft Sentinel analytics rules that generate high volumes of non-actionable closed incidents. The query calculates false positive, benign positive, undetermined, and true positive rates per rule, then provides practical tuning recommendations to help SOC and detection engineering teams reduce alert fatigue.