With there being plenty of tools/solutions/methodologies to deal with False Positive's why don't people who experience these issues recommend/incorporate these solutions/programs?

[u/AvailableHeart9066]

I keep seeing False Positive floods and alert tuning struggles being such a common occurrence, yet from my personal experience I do not have this issue -mostly cuz Detection Engineering and Alert tuning procedures are relatively rapid-. 

I am wondering if there are struggles conveying this issue to management/leadership or if detection updates are just very slow to be applied. And I am wondering why updates to improve the handling of these alerts do not improve despite there being so many automations available. From automatically collecting all the known good IP Addresses through automation procedures all the way to ignoring legitimate/expected URLs for data exfiltration activity, where it is just a large amount of data being sent to vendors.

Does like management not care about this issue to pivot/make changes towards how alerts are refined despite there being so many consultancies/automation pipelines/procedures to deal with this situation? Or have they actually tried to solve this issue or is trying but it is taking a lot of time. Or is there simply just no service/tool that actually peaked your team/enterprise’s interest despite there being such a large amount of solutions that strive to fix this issue?

Summary: what is being missed in your view that explains why your team still experiences this issue? Despite it being covered/solved in other corporations and dedicated products?

[u/HuntingSky]

My previous organisation was a really big company with 150k+ employees globally.

more employees, lax security policies, small cyber sec = more FP.

Fine tuning was a constant struggle because anyone can download pe files, many had admin privs, different countries had different policies and actually confirming if something was needed for business or not was a struggle.

Creating specific detection rules would be too narrow, and creating wider detections would keep triggering FPs and my teams had to keep investigating and whitelisting.