This is a placeholder post so the site has something to render. Replace it with your own — the frontmatter above (title, description, date, optional tag) is all a note needs.
Every alert I’ve ever written was wrong the first time. Not broken — it fired. It just fired at the wrong things, or at the right things in a way nobody could act on at 3am.
The pattern is always the same. You write the detection for the threat model in your head. Reality has a different threat model, and also a cron job that looks exactly like the thing you’re worried about.
What actually fixes it
Almost never a cleverer rule. Usually:
- A sentence in the alert that says what to do, not what happened.
- A single exclusion for the one noisy source that was 80% of the volume.
- Deleting it, because nobody ever acted on it and everyone had learned to ignore it.
The third one is the hardest to admit and the most useful.