Measuring incident quality to drive detection strategy

This report presents a methodology to quantify incident “quality” for detection strategy improvement: after finding entropy-based metrics insufficient, the authors define two complementary measures—signal strength (using capped per-detection counts, with an optional dynamic cap based on compromised assets) and dominance ratio (proportion of alerts from the single loudest detection). They combine these into a visualization (scatter plot with gradients and four quadrants: quiet, unstable, noisy, ideal) and a quarterly stacked-bar view to track progress over time, and note caveats such as not accounting for severity and the challenges of computing dynamic caps.