To reduce false positives from service accounts in unusual login alerts, which is most effective?

• A. Use asset tags to group known automation systems and exclude.
• B. Modify the rule to include principal.user.type != "service_account".
• C. Update rule to alert only when principal.user.email and principal.user.userid match in same event.
• D. Add a reference list of service accounts and suppress matches.

Answer: (B)

Filtering at the rule level by excluding service accounts based on identity type is the most effective way to cut false positives from automated activity. Service accounts are meant for automated processes, not for individual human access, so their login patterns often look anomalous to human-focused alert rules. By configuring the alert to ignore events where principal.user.type equals service_account, you prevent these routine automated logins from triggering the unusual login alert while still catching genuine human-origin anomalies.

This approach works well because it relies on a standard identity attribute that consistently distinguishes service accounts from human users across events. It avoids the maintenance burden of separate asset tags, manual suppression lists, or ad-hoc checks, which can become out of date or miss new service accounts. The other methods either require ongoing upkeep (asset tags, suppression lists), rely on less reliable heuristics (matching email to userid), or run the risk of accidentally muting legitimate alerts.