The cost of an alert is the pivot
Producing an alert is cheap. Deciding whether it matters is not, and every field the alert leaves out gets rebuilt by hand, once per firing.
Producing an alert is cheap. Deciding whether it matters is not.
An alert reading “suspicious process on HOST-42” is technically correct and practically useless. The analyst opens it, learns nothing, and starts pivoting. Into the EDR console for the process tree. Into the identity provider for who was logged in. Into the asset inventory to find out whether HOST-42 is a domain controller or the kiosk in reception.
Ten minutes later they know it was a backup agent.
Every one of those pivots rebuilds context the detection already had. At the moment the rule matched, the parent process, the command line, the account and the host role were all sitting in the event or one lookup away. Carrying them into the alert costs the rule a join. Leaving them out costs an analyst ten minutes, once per firing, forever.
The multiplication is the point. A sparse rule firing twenty times a day is not a twenty alert problem, it is a two hundred minute problem.
So the question to ask about a new detection is not only how often it will fire. It is what somebody has to open in order to close it. If the answer is more than one window, the enrichment belongs in the rule.
Pick your noisiest rule and time yourself triaging a single alert from it. That number, times the daily volume, is what the rule actually costs you.
CHECK YOURSELF
Two rules each fire 20 times a day. One names the host. The other names the host, the parent process, the command line and the account. Which costs more to run?
SHOW THE ANSWER
The first, because every alert starts with a pivot into another console
Why. Volume is the number everyone reports and it is only half the cost. The other half is minutes per alert, and a sparse alert spends those minutes rebuilding context the detection already had when it fired. Storage is almost never the constraint; analyst time always is. Sparseness also says nothing about whether an alert is wrong, only about how long it takes to find out.