When to use this
Use this record to review whether monitoring thresholds create useful alerts without hiding real incidents or overwhelming the response team.
Related controls
- A.8.16 Monitoring Activities
- A.8.15 Logging
- Monitoring Detection Use Case Register
- Log Review and Alert Triage Record
Threshold review
| Rule/use case | Current threshold | Alert volume | False positives | True positives | Missed detection concern | Proposed change | Risk impact | Approved by | Next review |
|---|---|---|---|---|---|---|---|---|---|
| TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
Minimum checks
- Alert volume is reviewed.
- False positives are understood.
- True positives are traced to event or incident records.
- Threshold changes are approved.
- Risk impact is considered before suppressing alerts.
- Template
- Iso27001
- Technological controls
- Monitoring
- Alert tuning
Note Metadata
Aliases: Alert Threshold Review
Source: 90 Templates/Monitoring Alert Threshold Review.md
Related Notes
- A.8.16 Audit Evidence Pack
- ISO 27001 A.8.15 - Logging
- ISO 27001 A.8.16 - Monitoring Activities
- A.8 Technological Controls MOC
- A.8 Technological Controls Implementation Guide
- A.8 Technological Controls Audit Guide
- A.8 Technological Controls Implementation Audit Risk Mapping
- A.8.16 Audit Checklist
- Log Review and Alert Triage Record
- Monitoring Detection Use Case Register
- Templates MOC