An alert fires for routine background traffic
A detector groups all sources together and triggers at ten failed attempts per minute. Ten workstations each mistype one password at morning login.
1. How would you test a detector intended to catch repeated failures from one workstation?
Read the worked answer
Group by the appropriate source identifier. Replay ten failures from one source in the time window as the positive case, then one from each of ten sources as the negative case. Check the actual source values in the logs.