Question

During a quarterly observability review, a SOC lead notices the detection platform has 480 enabled YARA-L rules, but a dashboard shows that 62 of them have not fired a single time in the past 18 months, while another 40 have fired but every alert was closed as false positive. Leadership wants a single, actionable metric to govern the health of the detection rule inventory going forward. Which metric best distinguishes rules that provide genuine defensive value from those that add maintenance burden without benefit?

Accepted Answer

Per-rule true-positive contribution rate, correlating each rule's alerts to confirmed incidents over a rolling window while flagging zero-fire and all-false-positive rules for review

Answer

Total number of enabled detection rules, tracked monthly to ensure the count keeps growing

Answer

Average events-per-second ingested across all log sources feeding the rules

Answer

Mean time to detect (MTTD) aggregated across the entire rule set