Alert Budget & Detection Quality
Import dispositioned alerts or a per-rule table. Get precision per rule, the alert budget your team can carry, time to detect and acknowledge, the false positives that cost the most analyst time, and the rules that have not caught anything in weeks.
Alerts stay in this tab. Nothing is uploaded or saved.
Team
Rules
| Rule | Fires a week | TP | FP | Benign TP | Triage min | ATT&CK | Weeks since TP | Remove |
|---|
Method: every metric, defined
All numbers come from the rule table above. Alert imports fill it in: each rule's alerts are counted by disposition, fires a week is the count over the window, triage minutes are the median handling time, and weeks since TP runs from the rule's last true positive to the newest alert. Timing needs alert-level imports, since a rule table has no timestamps.
Alert record. One JSON object per line. rule and disposition are required for precision; the four times are optional and accept ISO 8601 or epoch seconds or milliseconds. Dispositions read as TP (tp, true_positive, malicious), FP (fp, false_positive) or benign TP (btp, benign, benign_true_positive, authorized). Anything else, or none, is untriaged.
{"rule":"Password spray from one IP","disposition":"false_positive","technique":["T1110.003"],"event_time":"2026-10-12T03:14:09Z","alert_time":"2026-10-12T03:15:40Z","ack_time":"2026-10-12T03:22:05Z","close_time":"2026-10-12T03:41:30Z"}
Rule table. CSV with rule, fires_per_week, tp, fp, btp, triage_min, technique and weeks_since_tp. The CSV export re-imports as a rule table. pwnsy exports. Identity Anomaly Finder alerts (pwnsy.anomaly.v1 NDJSON, or its CSV) map the detector title to the rule and first_seen to event time. Sigma Rule Tester alerts map rule.title to the rule and entities.time to event time. Neither carries a disposition, so add a disposition field (or column) to each line after triage.
Alert budget FAQ
How is precision calculated?
Precision is TP / (TP + FP) per rule. Benign true positives, where the rule fired on real activity that turned out to be authorised, are left out of precision and counted in the actionable rate, TP / (TP + FP + BTP). The 95% range is a Wilson score interval, so a rule with only a handful of dispositions shows how uncertain its precision still is.
What is an alert budget?
The number of alerts a week the team can triage at its target pace: analyst-hours a week, times 60, times the share of shift time spent on triage, divided by the target minutes per alert. Alerts above the budget are the overrun. Load compares the real triage minutes each rule costs against the same capacity.
Why are false positives ranked by triage minutes?
A rule that fires 200 false positives a week at 3 minutes each costs less analyst time than one that fires 40 at 20 minutes. Tune cost is FP per week times triage minutes, the analyst time a week spent closing false positives, and the tune list is sorted by it.
Which files can I import?
Alert NDJSON or a JSON array with a rule name, a disposition and any of event_time, alert_time, ack_time and close_time; a CSV with the same columns; a per-rule table CSV with fires per week, TP, FP, benign TP and triage minutes; and the alert exports of the pwnsy Identity Anomaly Finder (pwnsy.anomaly.v1 NDJSON or CSV) and Sigma Rule Tester. Alerts without a disposition count as untriaged.
Are my alerts uploaded?
No. Parsing and every calculation run in JavaScript on this page. A share link carries only the rule table and team inputs, compressed into the part of the URL after the # sign, which browsers do not send to the server.
ATT&CK names and tactics come from the pinned MITRE ATT&CK v19.2 snapshot used by the coverage map. The sample alerts on this page are generated and fictional.