問題文
Before turning on a set of new detections, an engineer estimates the volume of alerts each one would produce. What decision does this estimate support, and what does it fail to capture?
選択肢
- It supports setting the throttle window, because the estimate reports the average interval between matches and the window should be set to that interval for the detection.
- It supports proving that the detection logic is correct, because a reasonable volume implies the search is matching the intended behavior rather than something unrelated in the underlying data.
- It supports choosing between the real time and continuous scheduling options, because a high volume implies the detection cannot finish in time and must be allowed to be skipped, which the setting permits.
- It supports deciding whether the team can absorb the workload and which detections need tuning first, but it reflects only the period measured, so seasonal patterns and a future change in the environment are outside the reach of the estimate.