Alert Volume and True-Positive Rate per Detection Rule
This lesson is part of the course
In this lesson
You summarise a week of triaged alerts by detection rule: alert counts, true positives, true-positive rate, and which noisy rules should be tuned first.
Buy the course once for $9.99 to unlock every lesson and lab, the final exam and the certificate – lifetime access, no subscription.
Lessons in this course
- Incident Timelines: MTTD, MTTR, Median and 90th Percentile Locked
- Alert Volume and True-Positive Rate per Detection Rule Locked
- Analyst Workload: Alerts per Analyst-Hour and the Queue Locked
- Vulnerability Backlog: CVSS Bands, SLA Days and Compliance Locked
- Patch Coverage by Asset Group Locked
- Phishing Simulations: Click Rate, Report Rate and the Trend Locked
- Risk-Based Prioritisation: CVSS × Exposure × Asset Value Locked
- Security KPI Dashboard: Targets, Direction and Flags Locked