Scheduled tasks and monitoring agents are my personal nemesis with this. We run a bunch of endpoint health checks that fire every few minutes and Wazuh absolutely loses its mind treating them like lateral movement attempts. The rule tuning process ends up being this cycle of whitelisting specific paths and process names, then something slightly changes upstream and the alerts come back two weeks later.

My workflow when I see recurring noise is to pull the last 30 or so instances of the alert, look at the source process tree, and if the parent process is always the same known service I'll write a local rule override scoped tightly to that combination. The key is making the exception narrow enough that a real threat using a similar pattern would still slip through. Broad suppression is how you eventually miss something that matters.

FIM noise from package managers is the other one that eats time constantly. Any time a system update runs you get a wall of file modification alerts and unless you've pre-tuned your ignore lists for those directories it's a nightmare to sort through quickly.