Every detection rule trades true-positive catch rate against false-positive noise — the art is finding the sensitivity that keeps both survivable.
alert if signal > sensitivity, else suppressed
precision = TP / (TP + FP)
- Log event sources — endpoints, firewalls and applications streaming events into the SIEM.
- Rule coverage — fraction of relevant attack techniques with an active detection rule.
- Background noise rate — volume of benign-but-unusual activity that could trigger false positives.
- Rule sensitivity — how aggressively a rule fires — higher catches more real attacks but also more noise.
Detection engineering teams tune exactly this dial daily — too sensitive drowns analysts in false positives, too loose lets real intrusions through unnoticed.