Nobody likes alerts that feel like a waste of time to review. But, how do you tell whether an alert is actually a waste of time? The go-to metric to use is false-positive rate—if an alert has high a false-positive rate then it’s “noisy” and might be getting rid of. But, trying to distill the performance of an alert down to a single number is hard and false-positive rate might be a particularly bad choice.
