High fidelity and high coverage pull in different directions
A rule tuned to alert only when it is certain will miss things. A rule tuned to catch everything will drown you.
There is no setting that is both, so every detection sits somewhere on that line and the position should be deliberate. Some things justify noise because missing them is unacceptable. Most do not. The mistake is not choosing badly, it is having a library where nobody chose at all.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Detection rules need regression testsRun the old cases again
- Behaviour often outlives static indicatorsThe footprints, not the coat