Automated adjustment of security alert components in networked computing systems

A method comprising:

• receiving a security alert utilized by a service provider system for a security detection associated with computing logs monitored for the security detection, wherein the security alert comprises a plurality of modular components;
• determining a first modular component from the plurality of modular components for the security alert;
• determining a first sampling number for the computing logs;
• filtering a first portion of the computing logs associated with the first sampling number based on the first modular component;
• determining whether first filtered data from the filtered computing logs of the first portion meets a first expected proportion for the first sampling number of the computing logs, wherein the determining whether the first filtered data meets the first expected proportion includes increasing the filtered first data by a scalar for a comparison to the first expected proportion;
• successively filtering other portions of the computing logs further using other ones of the plurality of modular components, a plurality of sampling numbers, and a plurality of expected proportions;
• and
• determining whether to adjust an alert frequency for each of the plurality of modular components of the security alert based on the comparison and the successive filtering, wherein the determining whether to adjust the alert frequency includes increasing second filtered data from the successively filtered other portions by the scalar.

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• receiving a security alert utilized by a service provider system for a security detection associated with computing logs monitored for the security detection, wherein the security alert comprises a plurality of modular components;
• determining a first modular component from the plurality of modular components for the security alert;
• determining a first sampling number for the computing logs;
• filtering a first portion of the computing logs associated with the first sampling number based on the first modular component;
• determining whether first filtered data from the filtered computing logs of the first portion meets a first expected proportion for the first sampling number of the computing logs, wherein the determining whether the first filtered data meets the first expected proportion includes increasing the filtered first data by a scalar for a comparison to the first expected proportion;
• successively filtering other portions of the computing logs further using other ones of the plurality of modular components, a plurality of sampling numbers, and a plurality of expected proportions;
• and
• determining whether to adjust an alert frequency for each of the plurality of modular components of the security alert based on the comparison and the successive filtering, wherein the determining whether to adjust the alert frequency includes increasing second filtered data from the successively filtered other portions by the scalar.