Abstract
Two related mechanisms for detection-content health in a multi-tenant security operations platform. First, a detection-blindness detector: a maintained dependency graph mapping each detection rule to the log tables its query reads is joined against per-tenant per-table ingestion volume and baselines, yielding a finding when a rule's required input table has stopped ingesting for a tenant, so the rule is silently blind even though it reports no failure. Second, a change-impact regression watch: a time-boxed watch, opened at a detection-rule change by the change pipeline or by an operator, compares post-change alert volume against the pre-change baseline and issues a verdict (collapsed, elevated, stable, low-baseline) per tenant across the fleet, catching a change that quietly broke a detection within days.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
AlpenShield GmbH, "Detecting Silently Blind Security Detections by Joining Rule-to-Source Dependencies Against Per-Tenant Ingestion, and Change-Impact Regression Watch for Detection Rules", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/11431