The client was searching for a solution to increase the efficiency of their analysts to manage and triage a flood of alerts from over 400 hard-coded rules in Splunk in order to separate false positives from true alerts. The client wanted to automate the process of checking each alert against other suspicious activities such as unusual increases in files being transferred, spikes in network traffic, and attempts to reach other known bad URLs. They were looking for a partner to help build a workflow that would speed up the process and decrease analyst work hours.