Settings

The detection, and what it is pointed at

All four as decimals: 0.95 is ninety-five per cent, 0.000002 is two in a million. The prevalence is the one nobody writes down and the one the answer turns on, so guess it honestly rather than leaving it flattering — the page is most useful when that number is uncomfortable.

What the queue actually is

What it costs, both ways

Precision and recall move in opposite directions, and the only honest way to choose between them is to price both: the hours the queue costs, and the genuine events that never reach anybody. A detection tuned until the queue is bearable is a detection that is missing things, and how many is computable from the same four numbers.

If a second detection had to agree

This assumes the two are independent, which they usually are not. Two rules keyed off the same parent process, the same host or the same log source are not two opinions. Where they are correlated the real false positive rate is higher than the product, sometimes by orders of magnitude, and the precision above is the best case rather than the expected one.

The working


    

Related tools