Tuning use cases without losing coverage

This is a sample post so you can see how everything looks. Edit it or delete it.

A code block

index=security sourcetype=WinEventLog:Security EventCode=4625
| stats count by user, src
| where count > 20

A list

1. Measure the noise first
2. Tune the smallest scope that fixes it
3. Re-test against known attack data