問題文
A courier company tightens the thresholds on its monitoring rules to cut the number of alerts that turn out to be harmless. Two weeks later an intrusion is found that produced no alert. Which trade-off does this illustrate, and what should the team do about it?
選択肢
- The tightening had no effect on detection because the intrusion used a method that no monitoring rule had been written for, so the change in thresholds is unrelated to the fact that no alert was produced during those two weeks.
- Reducing false positives raised the false negative rate so the team should tune each rule separately against known-bad and known-good examples, instead of moving every threshold in the same direction at once and hoping that detection holds up.
- The team should stop measuring false positives, because that measure encourages exactly the kind of tightening that caused the miss and a monitoring program is better judged by how many intrusions it finds.
- The team should return every threshold to its original value, because the earlier settings were the ones that had been validated when the monitoring platform was first installed and had not produced a missed intrusion until then.