ATLAS (Alert Threshold Lifecycle Assessment System) is a method for setting and reviewing security alert thresholds. Its goal is to make alerts useful without overwhelming analysts with false positives. A threshold should reflect both the measured activity and the organization’s acceptable risk, not just a convenient number. section 8.4 section 3.2.3
Start with the alert, then establish what should trigger it:
- Select an alert with a meaningful name. Add simpler alerts first rather than launching a batch that analysts cannot manage. section 8.4.1
- Define what it monitors, why it matters, and how it supports the security program. section 8.4.1
- Categorize it: zero-tolerance events warrant immediate investigation; policy violations use policy-set thresholds; anomaly alerts depend on analysis of behavior. section 8.4.1
- For an anomaly alert, collect relevant historical logs to establish a baseline and identify deviations. Review thresholds as threats or organizational needs change. section 8.4.1 section 3.2.3
Failed-login alerts
Ten failed logins in ten minutes might trigger a brute-force alert, while a password-lockout policy might require an alert on the third failed attempt. Choose the rule that fits the alert’s purpose, risk appetite, historical incidents, and policy; do not treat either number as universal. section 3.2.3 section 8.4.1
Judge the result by whether analysts can identify real threats and respond efficiently, not by alert volume alone. Refined monitoring and thresholds were associated with fewer failed-login events and less alert fatigue in a six-month organizational comparison. ATLAS needs no dedicated application: a spreadsheet can track its thresholds. section 8.3.1 section 8.4.3 section 8.4
