Lateral-movement detection flags east-west traffic between hosts that don't normally talk. Here's how to reduce false positives without losing real signal.
Lateral-movement detection compares current east-west flows against a learned baseline of which hosts normally talk to each other. Give it at least seven days of traffic before tuning, so the baseline reflects a real week, not a partial one.
Backup jobs, vulnerability scanners and configuration-management tools legitimately talk to many hosts at once. Add them to the allowlist under Detections > Lateral movement > Exclusions rather than raising the global sensitivity.
A flat, DMZ-facing segment should stay strict; a segment with legitimate broad east-west chatter (like a Kubernetes cluster) can run at a lower sensitivity without hiding a real attacker moving between segments.