https://sedward5.com/tags/detection-and-response/ Recent content in Detection and Response on Cyber Mixology Hugo en Thu, 23 Jul 2026 12:00:00 +0000 https://sedward5.com/wilson-scoring-for-detection-and-response/ Thu, 23 Jul 2026 12:00:00 +0000 https://sedward5.com/wilson-scoring-for-detection-and-response/ <p>Detection engineering teams often inherit a deceptively simple problem: how do you decide which detection rules are actually your best? Most teams already collect two useful metrics for every rule. First is <strong>precision</strong>—the percentage of alerts that analysts ultimately determine are legitimate security activity. Second is <strong>alert volume</strong> over a given period.</p> <p>Unfortunately, these metrics often point in different directions.</p> <p>A rule with 100% precision across 10 alerts sounds fantastic, but should you trust that result? Maybe. Maybe not. Ten alerts simply isn&rsquo;t much evidence.</p>