Topic starter
19/08/2026 3:56 pm
TL;DR: A method for scoring incident quality combines detection diversity, capped alert counts, and dominance ratio, according to Expel. The approach helps SOC teams measure resilience, track improvement over time, and tune detections toward clearer coverage, arguing that stronger incidents are those least likely to be missed if one detection fails.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Measuring incident quality to drive detection strategy”.
Key questions
Q: What makes an incident fragile from a detection perspective?
A: An incident is fragile when most of the evidence comes from one detection path, so the case can disappear if that detection fails or is muted.
Q: Why can a high alert count still be a weak signal?
A: A large number of alerts can still come from a single noisy rule, which creates repetition without redundancy.
Q: How do security teams know whether detection tuning is actually improving coverage?
A: They should look for a shift over time toward incidents with lower dominance and higher diversity of detections.
Practitioner guidance
- Score incidents for detection diversity and concentration Track both the number of unique detections and the dominance ratio so you can tell whether an incident is supported by multiple observations or one repeated alert path.
- Use capped counts for repeated detections Apply a default cap to repeated alerts so a loud rule does not overwhelm the score, then adjust the cap when the incident scope is clearly broader.
- Compare fragile, risky, decent, and robust incidents over time Review incident quality by quarter or other fixed period to see whether tuning is shifting cases away from single-point dependence and toward more balanced coverage.
Bottom line: Incident quality is better measured by resilience than by raw alert volume, because repeated alerts from one source can hide a fragile detection posture.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:32 pm
Incident quality is an operational resilience metric, not a reporting convenience. A SOC can have plenty of alerts and still miss the attack if those alerts come from one brittle detection path. The article’s core insight is that detection strength should be judged by redundancy and balance, because resilience disappears when one sensor failure erases the incident. Practitioners should treat this as a coverage question, not a volume question.
A question worth separating out:
Q: What should teams do when one detection accounts for most of an incident?
A: They should treat that case as a concentration risk and ask whether the same activity can be observed through another control, sensor, or analytic path. If not, the incident may be visible today but still vulnerable to future misses. The goal is to reduce dependence on one alert source.
👉 Read our full editorial: How to measure incident quality when detection strength varies