Auto-closing a detection's alerts versus deleting the rule - what changes about catching an intruder?

## The three levers A SOC with more detections than it can work has exactly three things it can do to any one rule: **tune** it so it fires less (narrowing its logic or scoping it, which is detection-engineering work), **automate** the verdict so alerts are closed without an analyst reading them, or **delete** the rule and stop detecting the behaviour. Interviewers ask about the second and third together because candidates routinely treat them as interchangeable ways of "getting rid of the noise". They are not. ## What auto-close actually does Auto-close leaves the detection intact. Telemetry is still collected, the rule still evaluates it, an alert is still produced, and a machine - a closure criterion - writes the verdict instead of a person. Four things survive: - **The alert exists.** It has an id, a timestamp, a host, an account. - **The underlying event is still there** (subject to retention), so a hunt or a post-incident timeline can find it. - **You can count it.** The rate of auto-closures per criterion is a measurable number that can itself be alerted on. - **You can replay the decision** - if, and only if, the closure record kept enough to reconstruct why it matched. What does *not* survive is the human judgment. Nobody looked. So an auto-closed alert proves that the rule fired and that a criterion matched. It does **not** prove the activity was benign, and a candidate who says "it was auto-closed, so it was a false positive" has stated the single most common wrong answer in this area. ## What deletion does Deleting the rule removes the last stage that turns telemetry into an alert. If the underlying telemetry is still collected and retained, you keep *evidence* while losing *detection*: you will not be told at the time, but a hunter or an examiner can still find the behaviour afterwards. If the deletion is accompanied by turning off the collection - dropping the log source because nothing consumes it any more - you lose both, and the intrusion leaves nothing at all. That distinction is the one worth stating out loud in an interview, because it is the compromise that often makes a deletion acceptable: stop detecting, keep the records. ## Why auto-close can be worse than deletion Deletion is honest. Everyone can see the rule is gone; a coverage review will show the technique uncovered; someone has to sign for it. An auto-close criterion applied to every alert from a rule produces the same practical blindness while the rule still appears on every dashboard as deployed and firing. Two consequences follow: 1. **The coverage claim is false.** A report saying "we detect this behaviour" is true about the rule and false about the outcome, because no human or downstream process ever acts on it. 2. **The criterion is an unreviewed detection written backwards.** A detection rule decides "suspicious" and gets peer review, testing and an owner. A closure criterion decides "benign" at far greater volume and, in most SOCs, was added by whoever was drowning that week. An adversary who can satisfy it gets a guaranteed close. ## What makes auto-close defensible - **The original event is retained**, not just a case summary, and for at least as long as the investigations that might need it. - **Closed cases are searchable in the same place as open ones.** A closure store that analysts cannot query is evidence you cannot reach. - **The closure record replays**: which criterion, which version, which field values matched, at what time. - **The criterion is scoped, owned and expiring** rather than a permanent global truth. - **A sample is read by a human**, so the criterion's error rate is measured rather than assumed. ## The queue reality behind the question The reason the question exists is that a small team watching a large estate cannot read everything, at any tuning level. So the choice is not "work it or automate it"; it is "which of these three levers, with what evidence, and who is told". The right answer names the lever, names what it costs, and names who is now blind - not a claim that the queue got smaller.