Application Tuning Phase

In the application tuning phase, you discover servers, investigate offenses, modify building blocks, tune false positives, optimize custom rules, and improve search performance.

Before you tune the application, you must wait 24 hours to enable JSA to detect the servers on the network, store events and flows, and create offenses based on existing rules.