LEARN. PRACTICE. GROW.Concept and mechanism
Detection depends on a chain: generating events, transporting them, interpreting them, applying rules, and responding. An active rule may receive an empty essential field after a parser change. Compare raw event, transformation, and normalized result before concluding behavior disappeared. Coverage needs a denominator: sixty valid sources among eighty expected sources represent seventy-five percent, with twenty gaps. Alert quality also has distinct measures. If fifty of two hundred reviewed alerts are true positives, precision is twenty-five percent. That does not determine recall without knowing missed incidents. Always explain the measurement population, interval, and limitations.
Guided application
In a fictional incident, the backend stops receiving events and the Collector queue grows. Capacity for twelve thousand events at one hundred per second, without output and with exercise units specified, lasts one hundred twenty seconds. Persistence helps recover the queue after restart but does not create infinite disk or remove retry limits. Check actual storage, capacity, permissions, and recovery. Do not interpret zero backlog after deleting data as successful delivery. In reporting to APS and management, separate destination unavailability, observed loss, and intervals still needing reconciliation. An alert-free interval during ingestion failure has a different meaning from an interval with valid sources and no detections.
TP=50, FP=150: precision=25%; unknown false negatives prevent recall calculation.
Common pitfalls
No alerts as no incidents; persistent queue as unlimited; inventory as ingestion; precision as recall.
Related topics: Governance, risk, and exceptions · Suppliers, data, and threats · Resilience and recovery dependencies
Establish path coverage before trusting the conclusion.
Reference: Collector resiliency · CAS-005 / SecurityX V5; objectives 3.0; launched 2024-12-17