Open cardosec

Case 31ABAE · Blue team / DFIR · L4 Advanced

Measuring Detection Quality

Practise as: Explain it · Interview · Deep diveLevel: L4 Advanced

Interview questionHow do you measure whether your detections are any good?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview As Deep dive
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Precision per rule (true positives over all alerts) and analyst time per alert show noise and cost.
  2. Recall needs testing: purple-team or emulation results show which attacks fired an alert and which did not.
  3. ATT&CK coverage maps mislead if one rule per technique counts as "covered"; techniques have many procedures.
  4. Track time to detect and time from a new threat report to a tested rule; retire rules that never fire and cannot be tested.

If the interviewer pushes back

  • Leadership wants a single number for detection coverage. What do you give them, and what do you warn them about?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09