You set one IDS scan-signature threshold estate-wide — why does that hide an intruder on your noisiest segment?

## A threshold is a claim about a baseline Any numeric tuning on a sensor — "alert only after twenty of these in a minute" — encodes an assumption: *normal here is below twenty*. That assumption is local. On a campus, the segments behind the wiring closets do not resemble each other at all. A print VLAN sees a handful of predictable flows. A test lab spends its day doing things that look, to a scan signature, exactly like reconnaissance. A lecture theatre is empty for eight weeks and then hosts four hundred devices at once. A single number cannot be simultaneously true about all of them. ## Which way it fails Set the number low enough to be meaningful on the quiet segments, and the lab produces a flood. The flood is what triggers the next mistake: someone widens a suppression, and now the whole thing is invisible rather than merely loud. Set it high enough to survive the lab, and you have made an estate-wide announcement about how much activity is free. An adversary does not need to know the number to benefit from it; anyone working slowly is under it. Worse, the margin between the bar and a given segment's real baseline is *largest on the noisy segments* — the lab has a high bar and, if the intruder is standing on a quiet host inside the lab range, a great deal of room beneath it. The place with the most tolerance is the place with the least scrutiny. ## What per-segment tuning actually buys and costs Moving to per-segment values makes each number a claim about a place you can defend: | Segment | Normal for a scan-like signature | A defensible threshold | | --- | --- | --- | | print VLAN | near zero | very low; almost anything is interesting | | test lab | continuous, high | high, and paired with a compensating view | | lecture theatre | zero, then bursty on the hour | low, with the burst window understood | | scanner source | enormous, weekly | scoped exception, not a global number | The cost is real and it is the reason people avoid it. You now own a set of numbers rather than one. Each was measured against a baseline that was true on a particular day. Baselines move for entirely non-security reasons: the lab is rebuilt, the print range is re-purposed for wireless clients, a new building comes online, the weekly scan changes its schedule. Nothing in the sensor announces that a baseline has drifted. And the failure mode of a stale threshold is quieter than the failure mode of a stale suppression. A suppression at least declares itself as an exception in a file. A threshold that has drifted out of usefulness still produces alerts, so the dashboard looks alive while the number underneath it no longer means what its author intended. ## Holding it honestly A few practices make this survivable rather than an ever-growing spreadsheet: - **Name a segment owner, not a value owner.** The person who can tell you the lab's baseline changed is the person who rebuilt the lab. Tie the threshold to that relationship. - **Give every number a measured origin.** Record what the baseline was, when it was measured, and over what window. A number without a provenance cannot be re-argued, only inherited. - **Set a re-measure trigger, not only a date.** Address-plan changes, new buildings and re-purposed ranges should force a review whether or not the calendar says so. - **Keep a compensating view on the segments with the highest bars.** If the lab has to tolerate a lot, keep its raw matches somewhere at lower severity so the tolerance is recoverable when you need to look backwards. - **Prefer fewer, coarser tiers over per-VLAN artistry.** Three defensible tiers that people maintain beat forty precise numbers nobody re-measures. ## The line to hold in an interview The wrong answer is "we raised the threshold until the noise stopped". That sentence describes buying quiet with coverage at an unknown exchange rate, estate-wide, in one move. The right answer says what the number is relative to, where that relationship is different, and what it costs — in review time and in ownership — to keep several numbers honest instead of one dishonest one.