Absolutely! Tuning alerts is a critically important feature of our service.   With your input, we customize the alerting, scoring and escalation procedures to eliminate false negatives and minimize false positives.  For both MDR Advanced and MDR Essentials customers, our SOC team will work with you during the onboarding process to tune the alerts accordingly.  Furthermore, we support on-going SIEM configuration changes to continually improve how we alert and communicate with your team.
For MDR Advanced customers, our team will additionally document and maintain a customized SIEM “runbook” to ensure it evolves as your business processes and people change.   This is designed to accommodate your changing IT environment, and to improve the means (time of day, escalation contacts, etc.) by which we communicate with your team.