alicansaykal.com

An alert without an owner is a decoration

· detection · blueteam

It is easy to end a quarter with four hundred new detection rules and a dashboard that goes up and to the right. It is much harder to end it with four hundred rules that a specific human has agreed to answer for.

The test I use is blunt. For any alert, ask:

  • Who gets woken up?
  • What are they supposed to do in the first five minutes?
  • What happens if they do nothing?

If the third answer is “nothing”, the alert is not a control. It is a log line with ambition. Turn it off, or turn it into something with a name attached.

Coverage numbers reward volume. Incidents reward ownership. Only one of those two shows up on the bad day.

< back to ideas