By use case
For noise & false positives
Most alert fatigue is not a detection problem. It is a "should never have fired" problem.
Subtraction — knowing what not to act on is its own dataset.
The problem
Every feed tells you what is bad. Almost none tell you what is fine.
A CDN edge address, a cloud egress range, a popular SaaS domain — these appear in threat feeds constantly and are almost never the thing you should act on. Without an authoritative known-good set, each one costs an analyst the same triage time as a real detection.
The fix is not a better badness score. It is subtracting the traffic that was never worth an alert in the first place, before it reaches the queue.
What answers it
The building blocks that solve it
RST Noise Control
The known-good dataset, maintained as a product rather than as a per-customer suppression list.
RST Threat Feed
Indicators scored and decayed, so low-confidence signal never reaches the top of the queue.
Published scoring
Source confidence, context score and time relevance — inspect why anything scored the way it did.
Measure it against your own queue.
The honest test is how many of last week’s alerts would not have fired. Run Noise Control over them and count.