Alert Budget & Detection Quality
Precision per rule and the alert load your team can carry.
Rules
| Rule | Fires a week | TP | FP | Benign TP | Triage min | ATT&CK | Weeks since TP | Remove |
|---|
Method: every metric, defined
All numbers come from the rule table above. Alert imports fill it in: each rule's alerts are counted by disposition, fires a week is the count over the window, triage minutes are the median handling time, and weeks since TP runs from the rule's last true positive to the newest alert. Timing needs alert-level imports, since a rule table has no timestamps.
Alert record. One JSON object per line. rule and disposition are required for precision; the four times are optional and accept ISO 8601 or epoch seconds or milliseconds. Dispositions read as TP (tp, true_positive, malicious), FP (fp, false_positive) or benign TP (btp, benign, benign_true_positive, authorized). Anything else, or none, is untriaged.
{"rule":"Password spray from one IP","disposition":"false_positive","technique":["T1110.003"],"event_time":"2026-10-12T03:14:09Z","alert_time":"2026-10-12T03:15:40Z","ack_time":"2026-10-12T03:22:05Z","close_time":"2026-10-12T03:41:30Z"}
Rule table. CSV with rule, fires_per_week, tp, fp, btp, triage_min, technique and weeks_since_tp. The CSV export re-imports as a rule table. pwnsy exports. Identity Anomaly Finder alerts (pwnsy.anomaly.v1 NDJSON, or its CSV) map the detector title to the rule and first_seen to event time. Sigma Rule Tester alerts map rule.title to the rule and entities.time to event time. Downloaded exports carry no disposition, so add a disposition field (or column) to each line after triage.
Send to Alert Budget. Four pwnsy tools hand their alerts to this page directly, in the formats above. Pipeline Lab sends its stream alerts with TP or FP from the seeded ground truth. Sigma Rule Tester sends each matched event, for one rule or the SigmaHQ pack, as TP when the event is labelled _expect: match and FP when it is labelled nomatch. Identity Anomaly Finder sends its findings untriaged and the ones you suppressed as FP. The Detection Workbench Analyze tab sends its starter-rule matches and anomaly findings the same way.
How it compares
Checked 2026-11-06 against the frameworks and products below. Each formula on this page is defined in the method section; this table says where it agrees with published practice.
| Reference | What it defines | Here |
|---|---|---|
| Sigma rules specification 2.1.0 | Levels informational to critical (critical is for "cases in which probability borders certainty") and the status lifecycle stable, test, experimental, deprecated, unsupported | Levels read from alerts and tables. Each rule gets a status suggestion from its measured precision and a level check |
| Palantir ADS framework | Nine sections every detection completes before production, including False Positives, Validation and Priority | Supplies the measured inputs for False Positives, Validation and Priority. The written sections stay in the rule repo |
| TheHive 5 KPIs | Time to detect, triage, acknowledge, qualify and resolve, from alert and case dates | TTD, TTA and time to close with the same start and end points; reads TheHive date, newDate, inProgressDate and closedDate |
| Splunk ES SOC operations dashboard | Mean time to triage and to resolution; dispositions True Positive, Benign Positive, two kinds of False Positive, Other, Undetermined | Reads disposition:1 to :4 and their labels. Other, Undetermined and unpublished codes count as untriaged |
| Elastic Security alerts | workflow_status and, from 9.2, workflow_reason (true_positive, benign_positive, false_positive, duplicate, automated_closure, other) | Reads original_time, @timestamp, workflow_status_updated_at and the ATT&CK threat block |
| Microsoft Sentinel | Classification TruePositive, BenignPositive, FalsePositive, Undetermined; the SecurityIncident table holds FirstModifiedTime and ClosedTime | Reads both the table and REST incidents. The REST API has no close time, so none is invented |
- Precision TP / (TP + FP) with a Wilson score interval follows standard binomial practice; benign true positives are split out, as Splunk and Sentinel do.
- Known limits: vendor exports are read from JSON or NDJSON (CSV needs the generic column names); Splunk disposition codes 0, 5 and 6 have no label in Splunk's docs, so they are left untriaged; SOC-CMM scoring is not reproduced.
Alert budget FAQ
How is precision calculated?
Precision is TP / (TP + FP) per rule. Benign true positives, where the rule fired on real activity that turned out to be authorised, are left out of precision and counted in the actionable rate, TP / (TP + FP + BTP). The 95% range is a Wilson score interval, so a rule with only a handful of dispositions shows how uncertain its precision still is.
What is an alert budget?
The number of alerts a week the team can triage at its target pace: analyst-hours a week, times 60, times the share of shift time spent on triage, divided by the target minutes per alert. Alerts above the budget are the overrun. Load compares the real triage minutes each rule costs against the same capacity.
Why are false positives ranked by triage minutes?
A rule that fires 200 false positives a week at 3 minutes each costs less analyst time than one that fires 40 at 20 minutes. Tune cost is FP per week times triage minutes, the analyst time a week spent closing false positives, and the tune list is sorted by it.
Which files can I import?
Alert NDJSON or a JSON array with a rule name, a disposition and any of event_time, alert_time, ack_time and close_time; a CSV with the same columns; a per-rule table CSV with fires per week, TP, FP, benign TP and triage minutes; and the alert exports of the pwnsy Identity Anomaly Finder (pwnsy.anomaly.v1 NDJSON or CSV) and Sigma Rule Tester. Pipeline Lab, Sigma Rule Tester, Identity Anomaly Finder and Detection Workbench also send alerts straight to this page with a Send to Alert Budget button. Alerts without a disposition count as untriaged.
What does the Sigma status column mean?
A suggestion on the Sigma status lifecycle from measured quality. Stable needs at least 20 TP plus FP and a 95% lower bound on precision at or above the floor; test means precision at or above the floor on a smaller sample; experimental means below the floor or no dispositions; deprecated means no true positive for the retire window. Rules marked critical with a lower bound under 90% and informational rules that raise alerts are flagged.
Are my alerts uploaded?
No. Parsing and every calculation run in JavaScript on this page. A share link carries only the rule table and team inputs, compressed into the part of the URL after the # sign, which browsers do not send to the server.
ATT&CK names and tactics come from the pinned MITRE ATT&CK v19.2 snapshot used by the coverage map. The sample alerts on this page are generated and fictional.