Skip to main content

Signals vs alerts

A signal is a piece of evidence about security-relevant behavior in an environment. Perpetual stores signals in datasets, preserving them for use in investigations, hunts, dashboards, and other detections. Signals from alertable detections also enter triage as alerts.

A signal records a security-relevant observation​

The significance of security-relevant behavior may emerge only when you examine it alongside other evidence.

  • A command may be routine for a system administrator and suspicious for a user who does not normally run it.
  • A midnight login from a new country carries more risk than a login during the user's normal hours from their usual location.
  • Repeated rejected push notifications followed by a successful login from a new country provide stronger evidence of account compromise than either activity alone.
  • An encoded PowerShell command followed by a connection to an unfamiliar destination provides stronger evidence than either activity alone.

In Perpetual, this sort of behavior is represented as signals.

Deploying a detection creates a signal dataset​

You build and maintain a database of signals using detections, whose queries are deployed as continuous tables. As a query computes new results, the table incrementally appends them as signal rows.

Signals in Perpetual must follow the signal schema. That shared shape supports several uses:

  • The shared fields let you query signals from different detections consistently during investigations and hunts.
  • Other detections can correlate common fields across signal datasets.
  • Dashboards can visualize signal activity across detections by using the common fields.

Signal datasets make detection results reusable​

A signal dataset preserves a detection's work. Each signal captures the result of detection logic that likely filtered, aggregated, or correlated underlying event activity. The resulting dataset is a tightly curated summary of security-relevant activity, an intermediate representation that later analysis can query without redoing the detection's work.

You can use this curated layer during investigations and hunts to reconstruct the behavior surrounding a potential compromise, find the same behavior on other entities, or uncover related activity that supports a hypothesis. Dashboards also can aggregate the same signal history to show where a behavior occurred and how its frequency changed over time.

Alertable detections send signals into triage​

An alert is a signal that Perpetual carries into triage as potentially worthy of a full investigation. A detection's configuration determines whether its signals are alertable. That setting applies to the detection. A query can set signal.skip_alert to true on an individual signal. Perpetual keeps that signal in its dataset and does not carry it into triage. Signal severity does not gate alert creation.

When Perpetual creates an alert, it keeps the signal in its dataset and links the alert directly to the original signal record. The same observation therefore remains available for queries while also entering triage.

Other detections can combine signals to recognize complex behavior​

Stored signals can become inputs to other detections. A detection query can combine events with signals produced by other detections, or combine signals from multiple other detections.

This lets each upstream detection capture one independently useful observation. A downstream detection can then relate those observations by entity, sequence, and time window to recognize complex behavior. The resulting signals can provide evidence for further detection or enter triage when the downstream detection is alertable.