High-Volume Alert Noise Masking Escalation Alerts on Same Entity
Surfaces entities generating an unusually high volume of low-fidelity alerts that can mask a true-positive escalation event — the alert-fatigue and untuned-tooling gap CISA identified as a root cause of Organization A's failed detection.
Microsoft Sentinel (KQL)
