Why can a signal be too noisy for a standing detection rule and still be worth hunting?

## Precision is a property of the rule, not of the behaviour When a detection engineer says a signal is too noisy, they mean something specific: over the firings the rule would produce, the share that turn out to be worth investigating is too low to justify the analyst time. That is a statement about a rule's arithmetic. It is not a statement that the behaviour is uninteresting, and confusing the two is one of the most expensive mistakes a security operations team makes, because the behaviours adversaries prefer are exactly the ones that blend into legitimate administration. ## The two cost models A standing rule's cost is the number of firings multiplied by the minutes each one takes multiplied by the years it lives. If a behaviour occurs a hundred times a week across the estate and one in five hundred instances is hostile, no severity setting fixes that; the queue simply fills. A hunt's cost is a fixed block of time, agreed up front. Crucially, the analyst is not producing a verdict per record. They are producing a characterisation of a population, and only the outliers get individual attention. ## What a hunt can do that a per-event rule cannot cheaply - **Stack counting, also called least-frequency analysis.** Group every install across the estate by product name and publisher and sort ascending by count. The service desk's sanctioned tool appears thousands of times; a product that appears on three machines is immediately interesting. A rule looking at one record has no idea whether it is looking at the thousandth or the third. - **Joining to a source of truth.** The endpoint-management platform knows which installs it deployed. Anything present but not deployed is a much smaller set. Enriching every firing of a real-time rule with that join is possible but often slow, stale or simply not wired up. - **Sweeping the whole retention window at once.** A hunt can ask 'in ninety days, which devices ever carried one of these' rather than deciding about today's records. - **Iterating.** The analyst sees the result, notices that one publisher accounts for most of the noise, and refines. A deployed rule cannot rewrite itself between firings. - **Human judgment on the tail.** The last twenty rows can be looked at by a person who knows the estate — which department, which laptop, which project — with no need to encode that knowledge into logic. ## The honest limits of the hunt A hunt that finds nothing is a real and useful result, but it is bounded in ways you must state. It covers the sources you queried, the hosts those sources actually reported from, and the window that was retained. It says nothing about a device that stopped reporting, a source you did not have, or the period before retention began. 'We found no unexplained remote-support agents in the installed-software inventory over the last ninety days' is defensible; 'the estate is clean' is not. A hunt also cannot substitute for detection over time. It is a snapshot. If the behaviour matters continuously, the finding should push you toward changing the estate so that the behaviour becomes rare enough to detect, rather than toward re-running the same hunt forever. ## When noise is fixable, and when it is not Sometimes the noise is a data problem: the rule was written without an enrichment that would have removed most of it, and once the deployment source of truth is available at evaluation time the precision becomes acceptable. Then the routing genuinely changes and a rule becomes viable — how you then build and maintain that rule is a separate discipline. Sometimes the noise is structural: the estate genuinely permits thousands of people to do the thing, and no enrichment separates hostile from routine because the actions are identical. Then a rule will never work, and the real fix is a configuration change that makes the behaviour rare — after which the residual becomes both rarer and far more meaningful. ## The failure mode to avoid The tempting middle path is to ship the noisy rule anyway at a low severity, into a queue nobody works. That gives you the false-positive cost, a coverage map that claims the technique is covered, and no detection at all. Either the signal is worth someone's time on every firing, or it belongs in a hunt, a ticket, or nowhere.