Alert Denoising
The alert denoising scenario filters, aggregates, and performs initial prioritization on large volumes of alerts generated by TDP / NDR / XDR and similar devices before passing them to alert triage, channel notifications, or Task Center.
The focus is not single-alert analysis. It is about reliably receiving alert streams, identifying duplicate alerts, aggregating similar events, and outputting the subset that requires human attention.
Sub-scenario
- Real-time NDR Alert Denoising Workflow: Based on the built-in Workflow
stream_alert_denoise, this applies fixed rules plus machine learning to suppress noise in HTTP traffic logs and NDR alerts generated by TDP, SkyEye, and similar devices.
Deployment Requirements
Alert denoising usually needs to run on a server and is not recommended for personal computers. Syslog, device callbacks, and log push data must be actively sent from security devices to the machine running Flocks. Personal computers usually do not provide a stable fixed address, always-on availability, or reliable network reachability.
Recommended server specifications:
| Item | Recommended configuration |
|---|---|
| Deployment Model | Cloud host or internal VM |
| CPU / memory | 8 cores, 32 GB |
| Disk | 500 GB, with reserved space for logs and intermediate results |
| Operating system | CentOS, Ubuntu, or Rocky Linux |
| Runtime mode | Long-running node suitable for log reception and task execution |
Network and Connectivity Requirements
Deployability depends primarily on network reachability between the Flocks server and security devices.
| Data path | Connectivity requirement | Notes |
|---|---|---|
| Flocks actively queries the TDP API | The Flocks server can access the TDP API address | Suitable for actively pulling alerts, scheduled queries, and enriching details |
| TDP pushes through Syslog | The TDP device can access the Syslog receiver address and port on the Flocks server | Suitable for continuously receiving log streams; usually requires Flocks to be deployed on a server |
Related Resources: Real-time NDR Alert Denoising Workflow · Alert Triage · Internal Security Product Integration · Task Center · Messaging & Alerting Integrations