https://nullthought.dev/tags/queueing-theory/Recent content in Queueing-Theory on null thøughtHugoen-gbMon, 13 Jul 2026 00:00:00 +0000https://nullthought.dev/posts/detection-engineering-understanding-alert-capacity/Mon, 13 Jul 2026 00:00:00 +0000https://nullthought.dev/posts/detection-engineering-understanding-alert-capacity/<h2 id="why">why</h2> <p><a href="https://nullthought.dev/posts/detection-engineering-what-matters-and-can-you-measure-success/">My last post</a> claimed that 3 things matter in a detection engineering program: coverage, quality, and capacity. In this post I want to spend some time exploring the last in more detail. Specifically, I want to introduce a method that can help us answer common questions that come up in this space. Some examples include:</p> <ul> <li>What total alert rate can the triage team handle?</li> <li>What expected alert rate is reasonable for deploying a new rule?</li> <li>What alert rate for an existing rule should trigger a review?</li> <li>How many triage analysts do we need?</li> <li>What is the payoff for automation?</li> </ul> <p>Having answers to these questions is important. A given capacity imposes an alert budget and there are material consequences to exceeding it. Examples include operational burnout, reduced efficacy and efficiency, and even complete functional collapse. While it is easy to handwave answers, we can do a lot better with a little effort.</p>