A rule that worked for four months is now firing constantly

Diagnose a problemHard

Problem. A detection rule ran cleanly for four months at around 25% precision. Over the last three weeks its alert volume tripled and its precision collapsed to about 3%. Analysts want it turned off. Walk me through it.

Before you reveal: say your answer out loud, as if you were in the real interview — get your reasoning across clearly first. There is no single correct answer: reading what the interviewer is really after and defending your own thinking is what makes an answer strong.

← Define success for a new insider-threat detectorSATA agrees with analysts 95% of the time. Go autonomous? →