Name: AI Network Security Lab
Author: MySimulator

Alerting policy

Alert threshold (anomaly score): 0.60

This case study models 6,000 network connections scored by an anomaly-detection model. Lower thresholds catch more true intrusions but flood the security team with false-positive alerts; higher thresholds cut noise but risk letting a real intrusion through unreviewed.

Shift outcome

Alerts raised—

True intrusions caught—

Analyst review hours—

Connections by anomaly score (red = alerted, ring = real intrusion)