Engineering
What can fire, what is noisy, and what blocks the rest.
What changed on this page
Engineering is five tabs: Coverage, Noise, Metrics, Blockers and Config, each its own address (?tab=).
Coverage draws its counts as tiles with a stacked bar. Noise has its own 7 or 30 day window. Blockers are cards, most-blocking first, with every blocked definition under them. Config can be filtered and grouped (Runtime, Integrations, Features).
The connector inventory is moving to Sources and the control plane to Health, Components (with restarts and start time); both are still read here, under Config, until then. Export saves the reading on screen as JSON.
Playbook coverageParsed fresh on every request from playbooks/definitions/ and the playbook catalog, and joined to the sources that delivered events. Never a stored number.
How many playbooks can fire today, which wait on data, and what blocks the rest.
Loading…
Loading…
Loading…
How this is measured
Loading…
Noise by familyCases, not definitions: every operational case opened in the last 30 days, grouped by the family prefix of its playbook id, with the share closed as false positive or benign.
Which families open the most cases in the last 30 days, and how much of it closed as false positive or benign: where tuning pays first.
Loading…
SOC metricsRead-only, from the case tables for this tenant. Ad-hoc search over events is Health · Explore.
Case volume by rule and family, false-positive rate, and median time to acknowledge and to close, over 7 or 30 days.
Loading…
What blocks the rest Grouped by what is missing, most-blocking first. A playbook blocked on more than one thing appears under each cause, so the counts can add up to more than the blocked total.
Loading…
Every blocked definition
ConfigurationStartup environment of this gateway process, not telemetry. Every row names its source variable.
The environment this gateway process started with, each row naming its variable.
Loading…
Connector inventory and control plane (moving to Sources and to Health › Components; still read here)
Connector inventory Every source that has delivered an event, counted live from soc.source_events and split into live and replayed. See Health for freshness and blind spots.
Every source that has ever delivered an event, split into live and replayed.
Loading…
Control plane
The Kubernetes API's account of this deployment's pods; a pod that is not ready shows here first.
Reading pod state…
Loading…