Introducing thresholds in Security Event Alerting: a z-score love story

What this post added

Introduced a static threshold alongside the existing z-score methodology for Security Event Alerts. This dual-pronged approach aims to reduce false positives by ensuring alerts are triggered only when a spike in security events is both statistically anomalous (z-score > 3.5) and exceeds a minimum raw event count (initially set at 200). This addresses the issue of z-scores becoming infinite for domains with low or zero baseline security events, and also prevents alerts on statistically significant but low-volume spikes.