How Many of the Alerts in This Queue Are Real BASERATE
A detection that catches 95% of what it looks for and fires on one benign event in a thousand can still produce a queue that is 99% noise. That is not a flaw in the detection.
The detection, and what it is pointed at
All four as decimals: 0.95 is ninety-five per cent, 0.000002 is two in a million. The prevalence is the one nobody writes down and the one the answer turns on, so guess it honestly rather than leaving it flattering — the page is most useful when that number is uncomfortable.
What the queue actually is
What it costs, both ways
Precision and recall move in opposite directions, and the only honest way to choose between them is to price both: the hours the queue costs, and the genuine events that never reach anybody. A detection tuned until the queue is bearable is a detection that is missing things, and how many is computable from the same four numbers.
If a second detection had to agree
This assumes the two are independent, which they usually are not. Two rules keyed off the same parent process, the same host or the same log source are not two opinions. Where they are correlated the real false positive rate is higher than the product, sometimes by orders of magnitude, and the precision above is the best case rather than the expected one.
The working
Questions people ask about BASERATE