False Positives, Coverage & Durability

What is it?

Detection quality has three axes: false positives (firing on benign), false negatives / coverage (missing variants), and durability (keying on behaviour that survives, not volatile artifacts like a hash or IP).

Why it matters

A noisy rule gets auto-closed; a brittle rule misses the next variant. Durable, precise detections keyed on behaviour are the ones a SOC actually trusts and keeps.

Where you see it

A rule keyed on `ParentImage=office AND CommandLine|contains:-enc` (durable behaviour) vs one keyed on a specific `Hash` (breaks on recompile).

What normal looks like

Detections on stable behavioural fields with a documented false-positive rate and an explicit note on what they do and do not cover.

What suspicious looks like

A rule on a hash or IP the attacker rotates (misses the next sample), or a rule so broad it fires on daily admin work (gets ignored).

How analysts investigate

Ask of any rule: what benign thing could trigger this (false positives), what variant would slip past (coverage), and does it key on behaviour or a volatile artifact (durability).

Common beginner mistakes

Keying a detection on a hash or IP that the attacker will simply rotate.
Optimizing only for zero false positives until the rule catches nothing real.

Durable beats specific

  brittle:  Hash: a1b2c3...        → attacker recompiles → MISS
  durable:  ParentImage|endswith Office
            AND CommandLine|contains '-enc'   → survives hash/IP change
  quality = few false positives + good coverage + durable behaviour

Detections keyed on durable behaviour survive rotation; hash/IP rules break on the next variant.

Quick check

Which detection is more durable?

A quick self-check — it doesn't affect your XP or progress.