To minimize false positives from service accounts in login alerts, which approach is most precise?

• A. Use asset tags to group known automation systems and exclude.
• B. Modify the rule to include principal.user.type != "service_account".
• C. Update rule to alert only when principal.user.email and principal.user.userid match in same event.
• D. Add a reference list of service accounts and suppress matches.

Answer: (B)

Focus on filtering at the rule level by the user type so service accounts are excluded. Service accounts are used for automated processes and often generate login events that aren’t security-relevant, so removing them from alerts directly targets the root of the false positives. Excluding events where principal.user.type equals service_account makes the alerting precise and scalable, because it automatically ignores all service-account logins without needing ongoing maintenance.

Asset tagging can help in some contexts, but it relies on consistent tagging across all systems and can miss or mislabel automation accounts, leading to gaps or false alerts elsewhere. Suppressing matches with a reference list works, but it requires maintaining an up-to-date list of every service account, which is error-prone as accounts change or new ones are added. Checking email and userid alignment addresses potential identity mismatches, but it doesn’t specifically reduce noise from service accounts and can still trigger on legitimate human activity.

So, excluding service accounts at the rule level directly minimizes false positives in a robust, scalable way.