  In place of in-house solutions, organizations are increasingly moving towards
managed services for cyber defense. Security Operations Centers are specialized
cybersecurity units responsible for the defense of an organization, but the
large-scale centralization of threat detection is causing SOCs to endure an
overwhelming amount of false positive alerts -- a phenomenon known as alert
fatigue. Large collections of imprecise sensors, an inability to adapt to known
false positives, evolution of the threat landscape, and inefficient use of
analyst time all contribute to the alert fatigue problem. To combat these
issues, we present That Escalated Quickly (TEQ), a machine learning framework
that reduces alert fatigue with minimal changes to SOC workflows by predicting
alert-level and incident-level actionability. On real-world data, the system is
able to reduce the time it takes to respond to actionable incidents by
$22.9\%$, suppress $54\%$ of false positives with a $95.1\%$ detection rate,
and reduce the number of alerts an analyst needs to investigate within singular
incidents by $14\%$.
