An IPS rule matched only intruder traffic for 90 days - what does that license, and what does it not, before it may drop on a ward network?

## What the record actually says A rule in alerting mode produces one kind of evidence: for each packet that crossed this sensor, in this position, during this window, here is whether the pattern matched and here is what it matched on. Everything you are entitled to conclude has to be derivable from that sentence. Derivable: over the traffic observed, the matches were adversary traffic and only adversary traffic - **if a human looked at them**. Counting alerts is not reviewing them. A rule that fired four thousand times and was never opened is not evidence; it is a number. Not derivable, and this is the whole question: ### 1. Coverage - the flows the window never contained A rule cannot false-positive on traffic that did not occur. On a ward or a plant floor the dangerous legitimate flows are precisely the rare ones: - a vendor's remote maintenance session, contracted twice a year, which uses tooling that looks like exploitation because functionally it is the same protocol call; - an annual or post-change validation run that exercises paths nothing else touches; - a failover or emergency procedure that only runs during an incident - so its first appearance under enforcement will coincide with the worst possible moment; - a seasonal production mode, a different recipe, a device type that arrives with the next capital purchase. A 90-day window is a sample, and the interviewer wants to hear you say which parts of the year it did not sample. ### 2. Stationarity - the rule and the estate both move Rule content updates change what the rule matches without changing its identifier. A firmware update changes what the equipment emits. A new vendor tool arrives. Any of these can turn a clean rule into one that matches authorised traffic, and none of them are visible in the historical record. This is why the licence carries a review date and is re-examined on rule-set updates rather than being granted once. ### 3. Position - the sensor sees a path, not a network Evidence is tied to where the sensor stands. Traffic that took another path, or a return direction that routes differently, was never offered to the rule. Promoting the same rule at another boundary reuses a conclusion drawn from different traffic. ### 4. Scope - a class is not a rule The request usually arrives as "promote this category". A category contains rules nobody reviewed, on traffic nobody sampled. Evidence is per rule. If the intent is to promote a class, then the class is what must be enumerated and reviewed, and in practice that collapses to promoting a much smaller set than was asked for. ## The distinction that carries the answer A clean record demonstrates the absence of *observed* benign matches. It cannot demonstrate the absence of benign traffic that *would* match. Those are different claims, and the second is the one enforcement depends on. You close the gap not by extending the window forever but by naming the candidates: sit with the people who run the ward or the line, list the legitimate flows that plausibly resemble what the rule looks for, and check each one deliberately - was it present in the window, and if not, when does it next run? ## What a defensible licence looks like - the **exact rules**, by identifier, not a category name; - the **segment and direction** - inbound to the clinical zone is a different decision from outbound; - the **traffic actually observed**, and the confirmation that matches were inspected, not counted; - the **named legitimate flows** that could match, each marked present-and-clean or absent-from-window; - the **window length justified against the operating cycle**, not against a round number; - a **review trigger**: rule-set update, firmware campaign, new device class, new vendor; - an **owner** who can revoke it. ## The wrong answer to aim at The answer a strong engineer still gives is "it has been clean for a quarter, that is enough". It treats a sample as a proof and a class as a rule. The correcting fact is that the observation window is a statement about traffic that happened, that the rarest legitimate flows are exactly the ones a quarter is least likely to contain, and that on a clinical or industrial estate the rarest flow is often the one running when something has already gone wrong.