Measuring use case performance
Throughout this book, we’ve deployed custom detections for multiple security technology stacks, including CSPM, EDR, NIDS, SIEMs, and RASPs. Different technologies in detection telemetry can generally be broken down into two categories: upstream of the SIEM and downstream at the SIEM.
There are a few key pieces of information that we need to capture to properly monitor our deployed use cases regardless of type:
- How often the detection has fired recently
- Runtime duration and load on security tooling
- SOC analyst’s analysis disposition of our alerts
While use case performance can also be affected by external factors, such as system resource capacity or event or log ingestion changes, we can generally expect recent use cases to work for a finite amount of time. If our underlying platforms are not in a healthy state, that should be corrected first before attempting to capture metrics for unit-level detections.
