How to read one of our alerts

An alert nobody understands is an alert that gets filtered, and a filtered alerting system has negative value — it consumed attention and returned nothing. So every incident we raise shows its working.

Score is not confidence

The score answers 'how bad is this if it is real'. Confidence answers 'how sure are we that it is real'. They move independently, and conflating them is the single most common misreading.

• High score, high confidence — act today.
• High score, low confidence — worth a look, but the evidence is thin. Often a single dramatic request from an otherwise unremarkable source.
• Low score, high confidence — something is definitely happening and it definitely does not matter yet. Recurrence is what makes these interesting.

The reasons list

Every incident lists the rules that fired and what each contributed, positive or negative. The negatives matter as much as the positives: a verified search engine crawler earns a substantial deduction, which is why Googlebot requesting your robots.txt does not wake anyone.

That list is deterministic. The same events always produce the same score, and no language model rewrites it. If a summary were generated fresh each time, the audit trail would mean nothing.

What a sequence means

The most valuable single signal we produce is order. Discovery, then enumeration, then probing the authentication surface, then something exploit-shaped. Any one of those alone is background noise on the public internet. In that order, from one source, inside a few minutes, it is a person or a tool working through your site deliberately.

Breadth counts too, and this was a real gap we had to fix. A scanner that requested nearly two hundred distinct paths and then sent SQL injection was originally scoring as low, because it never touched the specific stages our sequence rule expected. Volume of distinct targets is reconnaissance whether or not the attacker bothered with the full ladder.

When to close one

If you recognise the source as your own — a monitoring service, a penetration test you commissioned, a developer with a scanner — close it as a false positive rather than acknowledging it. That distinction is recorded, and it is the first question anyone asks if a breach is later traced back to an alert somebody dismissed.