An alert without an owner is a decoration
It is easy to end a quarter with four hundred new detection rules and a dashboard that goes up and to the right. It is much harder to end it with four hundred rules that a specific human has agreed to answer for.
The test I use is blunt. For any alert, ask:
- Who gets woken up?
- What are they supposed to do in the first five minutes?
- What happens if they do nothing?
If the third answer is “nothing”, the alert is not a control. It is a log line with ambition. Turn it off, or turn it into something with a name attached.
Coverage numbers reward volume. Incidents reward ownership. Only one of those two shows up on the bad day.