Skip to main content

Detection tuning

Detection tuning is the work of revising a live detection when recurring case outcomes show that its logic should change. Case lineage, closure codes, and investigation evidence let Simba find trends, identify the responsible detection logic, and iterate on a revision against event history. Simba can stage the tested change, but you must review its effect on exclusions and coverage and decide whether it ships.

Live detections need tuning as conditions change​

A detection encodes assumptions about which activity is suspicious and how that activity appears in the datasets it reads. The events available to a detection change when new systems start contributing records or existing sources change the fields they emit. Ordinary activity shifts as teams adopt new tools and change workflows, turning previously unusual patterns into routine behavior. Threat behavior evolves too, creating malicious patterns the original query was not written to recognize. The detection can become noisy, miss activity that now matters, or keep applying logic whose original premise no longer holds.

Tuning uses a live detection's alert volume and investigation outcomes to decide which activity its query should continue matching. Persistent noise can show that the query matches too broadly, consuming attention and weakening confidence in the detection. Tightening the query reduces that noise by removing matches, but in tightening the query, you must take care not to exclude the activity the detection was designed to catch.

Case outcomes can suggest a need for tuning​

Cases provide the evidence tuning needs. Closing a case in Perpetual requires you to classify its outcome with a closure code, making each outcome available as evidence about detection behavior. Perpetual preserves each case's lineage through the alerts, signals, and detections behind it, connecting that classification and the investigation evidence to the behavior that produced the case.

Closure codes make outcomes comparable across cases. The notes and analyses explain the evidence behind each outcome, giving Simba enough context to judge whether a repeated pattern calls for a detection change. Three closure codes can point toward different kinds of work:

  • False Positive - Incorrect Detection Logic may indicate a change to the detection query.
  • False Positive - Inaccurate Data may indicate a repair to an upstream parser or mapper.
  • Benign Positive - Suspicious But Expected may support excluding activity the team expects.

Each code identifies a possible direction. Simba uses the investigation evidence to determine whether repeated outcomes share a cause and where any repair belongs.

Simba can propose tuning changes​

A recurring case outcome identifies a tuning opportunity, but figuring out what needs changing requires analysis. You initiate that work by asking Simba about a detection. Simba can quickly find trends in the investigations and closure codes associated with it.

When a trend points to the detection itself, Simba can examine the investigation evidence, the current query, and the underlying events to find the logic producing the repeated outcome. Simba revises that logic according to the direction you give it. A team can preserve a repeatable tuning procedure in a skill for Simba to follow. Your request carries the direction for work the team has not encoded.

Simba writes a revised detection query, tests it against event history, and iterates on the logic until it addresses the pattern in the available evidence. Historical testing broadens the evidence beyond the cases that exposed the problem, but it cannot guarantee how the revised detection will behave against future activity. Once Simba has developed a tested revision, it stages the change in a changeset.

You decide what ships​

Perpetual is designed to keep the human detection engineer in control of detection content. Simba can analyze the tuning opportunity, write and test a revision, and stage the suggested change in a changeset, but it cannot commit changesets.

You review every proposed tuning change to decide which exclusions the detection should make and which coverage it must preserve. When the available evidence is too narrow, you can direct Simba to keep iterating against broader evidence. Only you can decide the revision is ready and commit the changeset.