An alarm can be a singular event, a series of events, a sequence of events or a scenario of events. Castra will help translate your events and scenarios into actionable detection methodology. Alarms should not be overwhelming and require frequent tuning. Yes you can have too many, in which case we turn to reports.
Can you have too few? Maybe not, maybe you are focusing on corporate policy enforcement, Castra will work with you to make the system work for you, in your environment. The ongoing relationship is what drives results in this frequently changing challenge.