Automated adjustment of security alert components in networked computing systems

Abstract

There are provided systems and methods for automated adjustment of security alert components in networked computing systems. An entity, such as an electronic transaction processor for digital transactions, may utilize threat detection within a security information and event management system. The threat detection may implement one or more processes to tune security alerts automatically, which can be done prior to deployment. A security alert may be broken into modular components, which may be run progressively, in increasing sampling numbers, against a set of computing logs to identify hits. The hits are compared to an expected proportion for each modular component to determine whether the modular component is providing proper results. Further, threat detection may utilize a system to obtain justifications for potentially malicious behavior to eliminate false positives. This may be done automatically when detecting suspicious activities.