Threshold Calibration — Threshold calibration adjusts the values or conditions that trigger monitoring alerts or other actions. Analysts evaluate whether settings identify relevant activity while producing a manageable level of false positives. Changes require testing and documentation because reducing alerts can also reduce detection.

Added November 6, 2026