A threshold is a claim about your environment
A counting rule's number encodes what was normal the day somebody set it. Environments move, the number does not, and nothing tells you it has drifted.
Every counting rule contains a number somebody chose. More than 50 failed logins. More than 10 files read. More than 3 new devices.
That number is not a security setting. It is a claim about what was normal in your environment on the afternoon it was typed.
Environments do not hold still. Headcount doubles. An SSO rollout changes how failures get recorded. A migration reshapes the data, a new office adds a time zone, a seasonal load pattern arrives every October. The number stays where it was through all of it.
So a threshold drifts in one of two directions and neither announces itself. Too low, and it becomes noise nobody reads. Too high, and it becomes silence that looks like safety.
There are two better habits than guessing. Derive the number from your own data rather than from a blog post, and write down the date you derived it. Then compare against the entity’s own history where you can, because “unusual for this account” survives an environment change in a way that “more than 50” does not.
Find your oldest counting rule. Work out what its number would be if you set it today, using this month’s data. The gap between that and the number in the rule is how far your detection has drifted from the place it is meant to describe.
CHECK YOURSELF
A rule alerts when an account exceeds 50 failed logins in an hour. It was tuned two years ago and has not fired since March. What is the most likely reason?
SHOW THE ANSWER
The environment moved and 50 no longer describes anything unusual
Why. A threshold encodes what was normal on the day somebody set it. Headcount grows, an SSO rollout changes how failures are recorded, a migration reshapes the data, and the number stays exactly where it was. A disabled rule is worth ruling out, and it would show up as a rule with no activity at all rather than one that stopped in March. A number that was always too high would never have fired in the first place. Drift is the common cause and the hard one to see, because the rule is still enabled, still running, and still describing an environment that no longer exists.